escape.js

function escapeHtml(str) {
  // TODO more
  return str
    .replace(/&/g, '&')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&lt;')
    .replace(/'/g, '&#39;')
    .replace(/"/g, '&quot;')
  ;
}

function html(strs, ...vars) {
  console.log(strs, vars);
  let out = [];
  strs = strs.slice();
  for (;strs.length;) {
    out.push(strs.shift());
    if (vars.length) {
      out.push(escapeHtml(vars.shift()));
    }
  }
  return out.join('');
}

let username = 'Bobby <Drop script="tables.js">';
let inline = html`<h1>Hero ${username}</h1>`;