function escape(unescaped) {
  return unescaped.replace(/[&<>]/g, match => `&#${match.charCodeAt(0)};`);
}
Tiny HTML escaping function, useful to protect against things like XSS and
unintentionally breaking attributes with quotes.

@param {String} unescaped - An HTML value, unescaped
@return {String} - An HTML-safe string