Data shapes Required
Insert text literally when you replace
When you insert outside text with a replace function, make sure the text goes in exactly as written. Many replace functions treat parts of the replacement as commands.
How to do it
In a replacement string, $&, $1 or \1 mean "the matched text" or "group 1". Content that happens to contain them comes out mangled. Pass a callback that returns the text, or use the language's quoting helper. A plain substring replace without patterns is also safe.
Example
// JavaScript: $&, $1 and $' are special in a replacement string
page.replace('<!--body-->', html); // Bad
page.replace('<!--body-->', () => html); // Good: a function is inserted as is
# Python: \1 and \g<0> are special in re.sub's replacement string
re.sub(r"<!--body-->", html, page) # Bad
re.sub(r"<!--body-->", lambda m: html, page) # Good
// PHP: $1 and \1 are special in preg_replace's replacement
preg_replace('/<!--body-->/', $html, $page); // Bad
preg_replace_callback('/<!--body-->/', fn($m) => $html, $page); // Good
// Java: $ and \ are special in replaceAll's replacement
page.replaceAll("<!--body-->", html); // Bad
page.replaceAll("<!--body-->", Matcher.quoteReplacement(html)); // Good
How to check
Insert the text $& $1 \1 $' through every template or replace step. The output contains those characters unchanged.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers architecture playbook: https://agentwranglers.se/playbook/architecture/data-shapes/literal-replacement.