Template: escape strings to prevent XSS.