/auth/lib/html.php; other repos carry a COPY. // HTML escaping for server-rendered pages. // Escape for HTML text and attribute context (quotes included, invalid UTF-8 replaced). function h(?string $s): string { return htmlspecialchars((string)$s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); }