Web

ServerHTML builds markup on the server. Elements are functions that take attributes and children, and rendering escapes every text node and attribute value, so data never turns into markup by accident. Raw HTML goes through the conspicuous ServerHTML.unsafe_raw.

  let link = ServerHTML.a(
    [
      ServerHTML.href("/search?q=a&b=\"c\""),
      ServerHTML.Attribute.known("title", "<b> & 'x'"),
    ],
    [ServerHTML.text("1 < 2 & 3 > 2")],
  );
  expect ✓ServerHTML.render_fragment(link) == "<a href=\"/search?q=a&amp;b=&quot;c&quot;\" title=\"&lt;b&gt; &amp; &#39;x&#39;\">1 &lt; 2 &amp; 3 &gt; 2</a>";

An element's class is not a string. It takes a CSS.Class.t, which only a css expression produces, so every class a page uses is one the compiler checked and put in the stylesheet.