feat: escape html in view params by default

Author: TorstenDittmann

src/View.php

@@ -77,12 +77,16 @@ public function __construct(string $path = '')
      *
      * @throws Exception
      */
-    public function setParam(string $key, mixed $value): static
+    public function setParam(string $key, mixed $value, bool $escapeHtml = true): static
     {
         if (\strpos($key, '.') !== false) {
             throw new Exception('$key can\'t contain a dot "." character');
         }
 
+        if (is_string($value) && $escapeHtml) {
+            $value = htmlspecialchars($value, encoding: 'UTF-8');
+        }
+
         $this->params[$key] = $value;
 
         return $this;