As illustrated by the patch here, this is not actually a case where we can get by with `.text()`. Escaping the prompt input (already done) and then building html with literals (already done) is perfectly safe.