Text inside of tags is HTML escaped.

spec/stdlib/template/builder-spec.coffee

@@ -30,6 +30,10 @@ describe "Builder", ->
       builder.tag 'div', 22
       expect(builder.toHtml()).toBe "<div>22</div>"
 
+    it "HTML escapes tag text", ->
+      builder.tag('div', "<br/>")
+      expect(builder.toHtml()).toBe "<div>&lt;br/&gt;</div>"
+
     it "can generate tags with attributes", ->
       builder.tag 'div', id: 'foo', class: 'bar'
       fragment = builder.toFragment()

src/stdlib/template/text.coffee

@@ -2,5 +2,11 @@ module.exports =
 class Text
   constructor: (@string) ->
 
-  toHtml: -> @string
+  toHtml: ->
+    @string
+      .replace(/&/g, '&')
+      .replace(/"/g, '"')
+      .replace(/'/g, ''')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')