// this should be on by default now I think, but it may break
// legacy code...
static new ThreadLocal<Bool> htmlencode_forParams_useV2;

sS htmlencode_forParams(S s) {
  if (s == null) ret "";
  if (isTrue(htmlencode_forParams_useV2!))
    ret htmlencode_forParams_v2(s);
    
  StringBuilder out = new StringBuilder(Math.max(16, s.length()));
  for (int i = 0; i < s.length(); i++) {
      char c = s.charAt(i);
      if (c > 127 || c == '"' || c == '<' || c == '>') {
          out.append("&#");
          out.append((int) c);
          out.append(';');
      } else
          out.append(c);
  }
  ret out.toString();
}

Began life as a copy of #1001263