docs: clarify AutoFormat HTML escaping behavior

Agent-Logs-Url: https://github.com/gofiber/fiber/sessions/e13b1223-74cf-4f5a-83f9-4c2cc4e2e9eb

Co-authored-by: gaby <835733+gaby@users.noreply.github.com>

Author: Copilot

ctx_interface_gen.go

@@ -2151,6 +2151,12 @@ func Test_Ctx_AutoFormat_XSS_Prevention(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, "<p>Price: 5 &lt; 10 &amp; 20 &gt; 15</p>", string(c.Response().Body()))
 
+	// Test that pre-rendered HTML is treated as plain text
+	c.Request().Header.Set(HeaderAccept, MIMETextHTML)
+	err = c.AutoFormat("<b>Hello, World!</b>")
+	require.NoError(t, err)
+	require.Equal(t, "<p>&lt;b&gt;Hello, World!&lt;/b&gt;</p>", string(c.Response().Body()))
+
 	// Test that normal text without special chars works fine
 	c.Request().Header.Set(HeaderAccept, MIMETextHTML)
 	err = c.AutoFormat("Hello, World!")

ctx_test.go

@@ -3,7 +3,6 @@ package fiber
 import (
 	"bufio"
 	"fmt"
-	"html"
 	"html/template"
 	"io"
 	"io/fs"
@@ -430,6 +429,7 @@ func (r *DefaultRes) Format(handlers ...ResFmt) error {
 // AutoFormat performs content-negotiation on the Accept HTTP header.
 // It uses Accepts to select a proper format.
 // The supported content types are text/html, text/plain, application/json, application/xml, application/vnd.msgpack, and application/cbor.
+// When text/html is selected, the body is treated as plain text and HTML-escaped before being wrapped in a <p> element.
 // For more flexible content negotiation, use Format.
 // If the header is not specified or there is no proper format, text/plain is used.
 func (r *DefaultRes) AutoFormat(body any) error {
@@ -458,7 +458,7 @@ func (r *DefaultRes) AutoFormat(body any) error {
 	case "xml":
 		return r.XML(body)
 	case "html":
-		return r.SendString("<p>" + html.EscapeString(b) + "</p>")
+		return r.SendString("<p>" + template.HTMLEscapeString(b) + "</p>")
 	case "msgpack":
 		return r.MsgPack(body)
 	case "cbor":