It's indeed easy to shit strings into HTML pages without consideration for context, escaping, and quoting, also known as injection attack vulnerability when sou

It's indeed easy to shit strings into HTML pages without consideration for context, escaping, and quoting, also known as injection attack vulnerability when sourced from user content, and plaguing PHP sites to this date. A better approach (and like processing instructions also from SGML's tool box) would be to use entities/text macros.