0. To embed JS code literally in <script>: Replace < to \x3C in sequences </ and <!--.
1. To interpolate inside an HTML tag:
   • Replace & to & first, and then
   • Replace < to <.
   Same to interpolate text in <title>;
   Keyword: RCDATA state.
2. To interpolate an attribute: additional " to " or ' to ' depending on which type of quotation marks.

   avoid unquoted user input (harder to escape)!

Notions

• Indispensible in any HTML framework, frontend- or backend-oriented
• Hard to do correctly if you are not a web pwner

References

• alert(1) to win: https://alf.nu/alert1
• The specification: https://html.spec.whatwg.org/multipage/parsing.html
• Hyper text literal by observablehq
• Utilities functions from SvelteKit: serialize_data.js escape.js.