My preference would be to do a separate dedicated test for this, so it's easier to see where something went wrong when the tests fail. It also allows us to add a test case for an XSS attack vector and verify that's escaped appropriately as well.