ok, so, using innerHTML won't convert anything because we also set to innerHTML.

I think that setting textContent and getting innerHTML convert entities (but not the quotes), but that's not what we're doing.

So I'd prefer if we stick to the safe `escapeHTML` and not try to be too clever here. And pass it "true" as second argument to escape the quotes too. (my preference would be to _always_ escape the quotes, I see no inconvenient in always doing this.

We could rewrite `escapeHTML` to make it faster by using replace only once, see https://github.com/janl/mustache.js/blob/master/mustache.js#L55 for example.