diff --git a/html.ts b/html.ts
index e265857..aba35de 100644
--- a/html.ts
+++ b/html.ts
@@ -1,5 +1,7 @@
 // Inspirado en https://gitea.nulo.in/Nulo/html.lua/src/commit/cb7e35dcca0e45b397baf628f5e1a162a2269638/html.lua
 
+import { escape } from "html-escaper";
+
 export interface VirtualElement {
   __element_type: string;
   things: Thing[];
@@ -51,7 +53,7 @@ export const section = basicElement("section");
 export const time = basicElement("time");
 
 // TODO: actually escape
-const escapeHTML = (string: string) => string;
+const escapeHTML = (string: string) => escape(string);
 export const render = (...elements: Renderable[]): string => {
   if (elements.length > 1) return elements.map((e) => render(e)).join("");
   if (typeof elements[0] == "string") return escapeHTML(elements[0]);
diff --git a/package.json b/package.json
index 611da56..58293e8 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,11 @@
   },
   "author": "Nulo <git@nulo.in>",
   "devDependencies": {
+    "@types/html-escaper": "^3.0.0",
     "@types/node": "^18.11.17",
     "typescript": "^4.9.4"
+  },
+  "dependencies": {
+    "html-escaper": "^3.0.3"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1ca0093..1b41876 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1,20 +1,36 @@
-lockfileVersion: 5.4
+lockfileVersion: '6.0'
 
-specifiers:
-  '@types/node': ^18.11.17
-  typescript: ^4.9.4
+dependencies:
+  html-escaper:
+    specifier: ^3.0.3
+    version: 3.0.3
 
 devDependencies:
-  '@types/node': 18.11.17
-  typescript: 4.9.4
+  '@types/html-escaper':
+    specifier: ^3.0.0
+    version: 3.0.0
+  '@types/node':
+    specifier: ^18.11.17
+    version: 18.11.17
+  typescript:
+    specifier: ^4.9.4
+    version: 4.9.4
 
 packages:
 
-  /@types/node/18.11.17:
+  /@types/html-escaper@3.0.0:
+    resolution: {integrity: sha512-OcJcvP3Yk8mjYwf/IdXZtTE1tb/u0WF0qa29ER07ZHCYUBZXSN29Z1mBS+/96+kNMGTFUAbSz9X+pHmHpZrTCw==}
+    dev: true
+
+  /@types/node@18.11.17:
     resolution: {integrity: sha512-HJSUJmni4BeDHhfzn6nF0sVmd1SMezP7/4F0Lq+aXzmp2xm9O7WXrUtHW/CHlYVtZUbByEvWidHqRtcJXGF2Ng==}
     dev: true
 
-  /typescript/4.9.4:
+  /html-escaper@3.0.3:
+    resolution: {integrity: sha512-RuMffC89BOWQoY0WKGpIhn5gX3iI54O6nRA0yC124NYVtzjmFWBIiFd8M0x+ZdX0P9R4lADg1mgP8C7PxGOWuQ==}
+    dev: false
+
+  /typescript@4.9.4:
     resolution: {integrity: sha512-Uz+dTXYzxXXbsFpM86Wh3dKCxrQqUcVMxwU54orwlJjOpO3ao8L7j5lH+dWfTwgCwIuM9GQ2kvVotzYJMXTBZg==}
     engines: {node: '>=4.2.0'}
     hasBin: true