sanitise string input for .create()

[bnjmnrsh]

Consider sanitising string input for .create(), or add a warning to notes if we want to add markup. Simple sanitisation would be to create a <template> with js, set it's innerHTML to the string and then retrieve it again, at which point any entities will be encoded.