[neeraj1235476]

The escape helpers behind HTML.format/% and ANSI.format/% miss characters that their own parsers treat as markup, so an interpolated value can still change the output:

• html_escape leaves ' alone: HTML("<style fg='{}'>x</style>").format("red' bg='blue") sets a background, and a plain apostrophe in a single-quoted attribute raises ExpatError
• ansi_escape leaves \x9b alone, which the ANSI parser accepts as CSI: ANSI("{}").format("\x9b31mred") recolors the text
• it also leaves \001/\002 alone, which wraps the value in a [ZeroWidthEscape] fragment that the renderer writes to the terminal unprocessed
  Both helpers now neutralize those characters the same way they already handle " and \x1b. Existing interpolation tests pass unchanged, since expat decodes ' back to '.

[jonathanslenders]

Thanks!