[kayodelycaon]

Ruby on Rails pretty much handles this. Regular strings are always escaped in views. Only html_safe strings will emit html. For user input, you should always use the sanitize method instead of raw. :)

[jiggawatts]

Razor pages in ASP will do this too: https://learn.microsoft.com/en-us/dotnet/api/system.web.ihtm...