foo claims to be escaped, but isn't

Content claims to be escaped, but it isn't.

Escape all tags and entities. < signs should become "&lt;"; > signs should become "&gt;"; & signs should become "&amp;".