This should be sanitized by passing it through `Y.Escape.html()`.