I'm fine with either escaping or limiting to a specific name, so long as we're not executing the name directly into the page.