Index: Cargo.lock
==================================================================
--- Cargo.lock	
+++ Cargo.lock	
@@ -627,10 +627,19 @@
 dependencies = [
  "cfg-if",
  "libc",
  "windows-link",
 ]
+
+[[package]]
+name = "html-escape"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1ad449764d627e22bfd7cd5e8868264fc9236e07c752972b4080cd351cb476"
+dependencies = [
+ "utf8-width",
+]
 
 [[package]]
 name = "http"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1628,10 +1637,11 @@
 version = "0.6.0"
 dependencies = [
  "async-compat",
  "config",
  "hostname",
+ "html-escape",
  "just-getopt",
  "lazy_static",
  "mail-parser",
  "mailin-embedded",
  "regex",
@@ -1976,10 +1986,16 @@
  "idna",
  "percent-encoding",
  "serde",
 ]
 
+[[package]]
+name = "utf8-width"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1292c0d970b54115d14f2492fe0170adf21d68a1de108eebc51c1df4f346a091"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"

Index: Cargo.toml
==================================================================
--- Cargo.toml	
+++ Cargo.toml	
@@ -8,10 +8,11 @@
 
 [dependencies]
 async-compat = "0.2.5"
 config = { version = "0.15", default-features = false, features = [ "toml" ] }
 hostname = "0.4.1"
+html-escape = "0.2.13"
 just-getopt = "2.0.0"
 lazy_static = "1.5.0"
 mail-parser = { version = "0.11", features = ["serde"] }
 mailin-embedded = "^0"
 regex = "1.11.1"

Index: src/tests.rs
==================================================================
--- src/tests.rs	
+++ src/tests.rs	
@@ -7,11 +7,11 @@
 
 #[test]
 fn check_valid () -> Result<()> {
 	let html = "<p>Some <b>valid</b> HTML</p>";
 	let res = validate(html).stack()?;
-	assert_eq!(res, html);
+	assert_eq!(res, "&lt;p&gt;Some &lt;b&gt;valid&lt;/b&gt; HTML&lt;/p&gt;");
 	Ok(())
 }
 
 #[test]
 #[should_panic = "Telegram closing tag found."]

Index: src/utils.rs
==================================================================
--- src/utils.rs	
+++ src/utils.rs	
@@ -1,7 +1,10 @@
 use crate::Cursor;
 
+use std::borrow::Cow;
+
+use html_escape::encode_text;
 use lazy_static::lazy_static;
 use regex::Regex;
 use stacked_errors::{
 	bail,
 	Result,
@@ -18,12 +21,13 @@
 	pub data: Cursor<Vec<u8>>,
 	pub name: String,
 }
 
 /// Pass any text here to be validated as not breaking from Telegram preformatted blocks
-pub fn validate (text: &str) -> Result<&str> {
+/// escape all HTML chars afterwards
+pub fn validate (text: &str) -> Result<Cow<'_, str>> {
 	if RE_CLOSING.is_match(text) {
 		bail!("Telegram closing tag found.");
 	} else {
-		Ok(text)
+		Ok(encode_text(text))
 	}
 }