Yes, and as a side-effect, if users override _confirm() they can choose not to escape anything at all.