 We can also see that there's no need to "escape" otherwise meaningful characters like & and > as & and > entities.All string content is automatically escaped because it is considered to be pure content, and has no tags or entities in it.This also means it is much easier to insert autogenerated content and that there is no danger that we might forget to escape user input when we display it to other users (which could lead to all kinds of cross-site scripting attacks or other development annoyances).