we want to escapeHTML that href and that url.

can't we return a DOM node instead of a string ? this way we could use setAttribute and textContent, which feels better