Worth `CGI.escape`-ing the value, just for correctness’ sake?