Hiccup, the Clojure HTML rendering library, doesn't escape by default. Yikes.