`jinja2.escape()` is safer, if you really just want to escape all HTML.

`bleach.clean()` is slower but will allow some HTML.