Sanitised user input
Interpolated values are now HTML-escaped