This is still not true for quotes... and we need to escape them.

Just call escapeHTML in every conditions, with the second argument set to "true". let's be safe instead of clever. I don't care of the performance here.

As I previously said, you can change the implementation of escapeHTML (with unit tests) to use the one from Mustache [1] instead

[1] https://github.com/janl/mustache.js/blob/master/mustache.js#L55