placeholderEscape example

$value = '';
      }
      switch ($key[0]) {
        case '@':
          // Escape if the value is not an object from a class that implements           // \Drupal\Component\Render\MarkupInterface, for example strings will           // be escaped.           // Strings that are safe within HTML fragments, but not within other           // contexts, may still be an instance of           // \Drupal\Component\Render\MarkupInterface, so this placeholder type           // must not be used within HTML attributes, JavaScript, or CSS.           $args[$key] = static::placeholderEscape($value);
          break;

        case ':':
          // Strip URL protocols that can be XSS vectors.           $value = UrlHelper::stripDangerousProtocols($value);
          // Escape unconditionally, without checking whether the value is an           // instance of \Drupal\Component\Render\MarkupInterface. This forces           // characters that are unsafe for use in an "href" HTML attribute to           // be encoded. If a caller wants to pass a value that is extracted           // from HTML and therefore is already HTML encoded, it must invoke           // \Drupal\Component\Render\OutputStrategyInterface::renderFromHtml()