Understood, but if I insert a string into a database that looks like this:

  <script>alert("yoov bin acked")</script>

And that's my username, if it's naively inserted inside some HTML it'll look like HTML to a browser.

So I was wondering if this framework auto-HTML-escapes strings inserted into places where text can go.