Fancier string manipulation is still just string manipulation. The more correct way to handle it would be to use something like an xml-builder to construct your html, which could then automatically escape all of the given text-node data appropriately.