Say I have some external (unsafe) data

unsafe_data = "some unsafe data"

I want to render this using Phoenix.HTML.Tag.content_tag/2

content_tag(:p, "<i>#{unsafe_data}</i>") |> safe_to_string

It will render:

"<p>&lt;i&gt;some unsafe data&lt;/i&gt;</p>"

This will create html entities, so <i> will be literally printed on the screen.
So I can use Phoenix.HTML.raw/1:

content_tag(:p, raw "<i>#{unsafe_data}</i>") |> safe_to_string

However, this should not be secure.

Maybe I have to do the following?

unsafe_data = safe_to_string(html_escape(unsafe_data)) # <- does that make any sense?

content_tag(:p, raw "<i>#{unsafe_data}</i>") |> safe_to_string

Thank you for any help!