Most likely it escapes enough to prevent code execution, but last time I tried it didn't escape all special characters out of the box:

https://news.ycombinator.com/item?id=29071196