Understood, but if I insert a string into a database that looks like this: <script>alert("yoov bin acked")</script> And that's my username, if it's naively

Understood, but if I insert a string into a database that looks like this: <script>alert("yoov bin acked")</script> And that's my username, if it's naively inserted inside some HTML it'll look like HTML to a browser. So I was wondering if this framework auto-HTML-escapes strings inserted into places where text can go.