The first fix I did was to do html.EscapeString(Text()),
but this is very problematic because now I need to
handle certain contexts, such as <scripts> to avoid
causing the scripts to break.

The proper fix is to use Raw() instead of Text(),
since Text() alone will return the unescaped
contents, and that's a big security risk.