Escape markup so it shows up as text.
Escaping goes through the browser’s own text node, so the result is exactly what the parser considers safe — no hand-written character list to get wrong.