display() should escape by default (#915)

- display(some_str) escapes the string by default. This is almost always what you want

- display(some_obj) calls repr(obj) and escapes the result. Again, it's a very sensible default

- if you want to inject some raw HTML in the output, you can use the new HTML class: display(HTML("<p>hello</p>")).

pyscriptjs/tests/integration/test_02_output.py

@@ -1,3 +1,4 @@
+import html
 import re
 
 import pytest
@@ -201,6 +202,30 @@ class TestOutput(PyScriptTest):
             == "['A', 1, '!']\n{'B': 2, 'List': ['A', 1, '!']}\n('C', 3, '!')"
         )
 
+    def test_display_should_escape(self):
+        self.pyscript_run(
+            """
+            <py-script>
+                display("<p>hello world</p>")
+            </py-script>
+            """
+        )
+        out = self.page.locator("py-script > div")
+        assert out.inner_html() == html.escape("<p>hello world</p>")
+        assert out.inner_text() == "<p>hello world</p>"
+
+    def test_display_HTML(self):
+        self.pyscript_run(
+            """
+            <py-script>
+                display(HTML("<p>hello world</p>"))
+            </py-script>
+            """
+        )
+        out = self.page.locator("py-script > div")
+        assert out.inner_html() == "<p>hello world</p>"
+        assert out.inner_text() == "hello world"
+
     def test_image_display(self):
         self.pyscript_run(
             """