Hero does have escaping. Its syntax is <%= variable %>.