I would actually say Django has a very poor HTML escaping facility. (Though, better than Rails, for what that's worth.) I feel like I've used template language

I would actually say Django has a very poor HTML escaping facility. (Though, better than Rails, for what that's worth.) I feel like I've used template languages that actually understand XML (or HTML) and thus have context sensitive escapes. It was probably written in something gross like Java, so URLs were output verbatim in links, while say instances of "/search?q=" + someVariable would url escape someVariable in links, and html escaped in tag contents.