It actually differs based on whether the input is HTML encoded or not.

Doing it this way provides flexibility, because if one provided HTML encoded values and there is only the `encode` call, it'll double-encode the value (which is obviously wrong).

If one provided HTML decoded values and they're output as-is, the potential of XSS becomes much higher in certain use cases.

Doing it this way, one could provide HTML decoded or encoded values and it'll output HTML encoded data.

Hope that helps :-)