mathers

I think it makes sense to escape as close as possible to the context where the data will be used, see https://benhoyt.com/writings/dont-sanitize-do-escape/