duckweb_escape

scalar · LOAD duckweb

duckweb_escape(VARCHAR) -> VARCHAR

HTML-escapes text for a page.

duckweb_chunk('<p>' || duckweb_escape(n.body) || '</p>')

Replaces the five characters that can break out of a text node or an attribute: &, <, >, " and '. Anything else is passed through unchanged, so non-ASCII text is untouched.

Anything a duckweb_tpl placeholder interpolates already goes through this unless the template opted out with {{raw:...}}. Call it directly when you are concatenating rather than templating — which, in a render macro built out of ||, is most of the time.