SafeSubstitution  

Carries values through a formatter without letting them be parsed.

Email bodies are translation strings containing markup — a markdown link whose text is a discussion title, say — that get rendered by the formatter after their parameters are substituted in. Substituting first means the parser sees the values: a title can close the link and choose its own destination, or add an image that loads when the mail is opened. Values are therefore replaced with an opaque marker before rendering, and put back — HTML-escaped — afterwards. The marker is deliberately plain (letters and digits only) so that neither markdown parsing nor URL encoding alters it, and it encodes the value inline rather than in shared state, so that repeated or nested renders in one request cannot mix values up.