// Created on savesnippets.com · https://savesnippets.com/Kh0db4d4bGv4Eq
function esc(s: unknown): string {
  return String(s).replace(/[&<>"']/g, c => ({
    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
  }[c]!));
}

export function html(strings: TemplateStringsArray, ...values: unknown[]): string {
  return strings.reduce((acc, str, i) =>
    acc + str + (i < values.length ? esc(values[i]) : ''), '');
}

const name = '<script>alert(1)</script>';
const out  = html`<p>Hello, ${name}!</p>`;
// '<p>Hello, &lt;script&gt;alert(1)&lt;/script&gt;!</p>'