The tag has a 'filter' attribute that controls HTML escaping. When filter='true' (or filter is not specified, as true is default), the tag converts HTML markup characters like <, >, &, ' to their entity equivalents (<, >, &, ') to prevent XSS attacks. When filter='false', it outputs content as-is without conversion.