don't use properties on non-html elements like svg
always cast to string before escaping