diff --git a/_includes/cask.html b/_includes/cask.html
index 09251ef485ab..6c05a5f4a8ec 100644
--- a/_includes/cask.html
+++ b/_includes/cask.html
@@ -1,11 +1,11 @@
 
         <td>
 {%- if site.data.cask[include.token] != nil -%}
-            <a href="{{ site.baseurl }}/cask/{{ include.token }}">{{ include.token }}</a>
+            <a href="{{ site.baseurl }}/cask/{{ include.token | uri_escape }}">{{ include.token | escape }}</a>
 {%- else -%}
             {{ include.token }}
 {%- endif -%}
         </td>
-        <td>{{ include.cask.version | truncate: 25 }}</td>
-        <td>{{ include.cask.desc | xml_escape }}</td>
-        <td>{{ include.cask.name.first }}</td>
+        <td>{{ include.cask.version | truncate: 25 | escape }}</td>
+        <td>{{ include.cask.desc | escape }}</td>
+        <td>{{ include.cask.name.first | escape }}</td>
diff --git a/_includes/formula.html b/_includes/formula.html
index f13616278673..0d3a35d43767 100644
--- a/_includes/formula.html
+++ b/_includes/formula.html
@@ -1,8 +1,8 @@
 
-        <td><a href="{{ site.baseurl }}/{{ include.formula_path || default: "formula" }}/{{ include.formula.name }}"
+        <td><a href="{{ site.baseurl }}/{{ include.formula_path || default: "formula" }}/{{ include.formula.name | uri_escape }}"
             {%- if include.formula.disabled %} class="disabled" title="This formula has been disabled"
             {%- elsif include.formula.deprecated %} class="deprecated" title="This formula has been deprecated"
             {%- endif -%}
-            >{{ include.formula.name }}</a></td>
-        <td>{{ include.formula.versions.stable }}</td>
-        <td>{{ include.formula.desc | xml_escape }}</td>
+            >{{ include.formula.name | escape }}</a></td>
+        <td>{{ include.formula.versions.stable | escape }}</td>
+        <td>{{ include.formula.desc | escape }}</td>
diff --git a/_includes/install_command.html b/_includes/install_command.html
index 2e1b6ab36ddd..c833c6f51f90 100644
--- a/_includes/install_command.html
+++ b/_includes/install_command.html
@@ -2,6 +2,6 @@
 <div class="install">
     <span class="label">Install command: </span>
     <div class="copyable">
-        {%- highlight bash -%} brew install{{include.modifier}} {{include.item}} {%- endhighlight -%}
+        {%- highlight bash -%} brew install{{include.modifier}} {{include.item | escape}} {%- endhighlight -%}
     </div>
 </div>
diff --git a/_layouts/analytics.html b/_layouts/analytics.html
index 614a6dc61f8d..b8aa209e9d5c 100644
--- a/_layouts/analytics.html
+++ b/_layouts/analytics.html
@@ -40,27 +40,27 @@ <h4>Total Events: {{ analytics_data.total_count }}</h4>
         <td class="number-data">#{{ item.number }}</td>
         <td>
     {%- if page.category == "os-version" -%}
-            <code>{{ item.os_version }}</code>
+            <code>{{ item.os_version | escape }}</code>
     {%- elsif page.category == "homebrew-devcmdrun-developer" -%}
-            <code>{{ item.devcmdrun_developer }}</code>
+            <code>{{ item.devcmdrun_developer | escape }}</code>
     {%- elsif page.category == "homebrew-os-arch-ci" -%}
-            <code>{{ item.os_arch_ci }}</code>
+            <code>{{ item.os_arch_ci | escape }}</code>
     {%- elsif page.category == "homebrew-prefixes" -%}
-            <code>{{ item.prefix }}</code>
+            <code>{{ item.prefix | escape }}</code>
     {%- elsif page.category == "homebrew-versions" -%}
-            <code>{{ item.version }}</code>
+            <code>{{ item.version | escape }}</code>
     {%- elsif page.category == "cask-install" -%}
         {%- if site.data.cask[item.cask] != nil -%}
-            <a href="{{ site.baseurl }}/cask/{{ item.cask }}"><code>{{ item.cask }}</code></a>
+            <a href="{{ site.baseurl }}/cask/{{ item.cask | url_encode }}"><code>{{ item.cask | escape }}</code></a>
         {%- else -%}
-            <code>{{ item.cask }}</code>
+            <code>{{ item.cask | escape }}</code>
         {%- endif -%}
     {%- else -%}
         {%- assign full_name = item.formula | split: " " | first -%}
         {%- assign data_name = full_name | remove: "@" | remove: "." | replace: "+", "_" -%}
         {%- assign formula = site.data.formula[data_name] -%}
         {%- if full_name == formula.name -%}
-            <a href="{{ site.baseurl }}/formula/{{ full_name }}"><code>{{ item.formula | escape }}</code></a>
+            <a href="{{ site.baseurl }}/formula/{{ full_name | url_encode }}"><code>{{ item.formula | escape }}</code></a>
         {%- else -%}
             <code>{{ item.formula | escape }}</code>
         {%- endif -%}
diff --git a/_layouts/cask.html b/_layouts/cask.html
index 570c4ac58554..701e67f67526 100644
--- a/_layouts/cask.html
+++ b/_layouts/cask.html
@@ -6,11 +6,11 @@
 {%- assign formula_path = "formula" -%}
 {%- assign c = site.data.cask[token] -%}
 <h2
-    {%- if c.disabled %} class="disabled" title="This cask has been disabled since {{ c.disable_date }} because it {{ c.disable_reason }}"
-    {%- elsif c.deprecated %} class="deprecated" title="This cask has been deprecated since {{ c.deprecation_date }} because it {{ c.deprecation_reason }}"
+    {%- if c.disabled %} class="disabled" title="This cask has been disabled since {{ c.disable_date | escape }} because it {{ c.disable_reason | escape }}"
+    {%- elsif c.deprecated %} class="deprecated" title="This cask has been deprecated since {{ c.deprecation_date | escape }} because it {{ c.deprecation_reason | escape }}"
     {%- endif -%}
     >
-    {{ token }}
+    {{ token | escape }}
     {%- if c.disabled %} (disabled)
     {%- elsif c.deprecated %} (deprecated)
     {%- endif -%}
@@ -19,19 +19,19 @@
 {%- include install_command.html item=token modifier=" --cask" %}
 <p class="names">Name{%- if c.name.size > 1 -%}s{%- endif -%}:
 {%- for name in c.name %}
-    <strong>{{ name }}</strong>
+    <strong>{{ name | escape }}</strong>
     {%- unless forloop.last -%}, {% endunless %}
 {%- endfor -%}
 </p>
 {%- if c.desc %}
-<p class="desc">{{ c.desc }}</p>
+<p class="desc">{{ c.desc | escape }}</p>
 {%- endif %}
-<p class="homepage"><a href="{{ c.homepage }}">{{ c.homepage }}</a></p>
+<p class="homepage"><a href="{{ c.homepage | escape }}">{{ c.homepage | escape }}</a></p>
 
-<p><a href="{{ site.baseurl }}/api/cask/{{ token }}.json"><code>/api/cask/{{ token }}.json</code> (JSON API)</a></p>
-<p><a target="_blank" href="{{ site.taps.cask.remote }}/blob/{{ c.tap_git_head }}/{{ c.ruby_source_path }}">Cask code</a> on GitHub</p>
+<p><a href="{{ site.baseurl }}/api/cask/{{ token | uri_escape }}.json"><code>/api/cask/{{ token | escape }}.json</code> (JSON API)</a></p>
+<p><a target="_blank" href="{{ site.taps.cask.remote }}/blob/{{ c.tap_git_head | url_encode }}/{{ c.ruby_source_path | uri_escape }}">Cask code</a> on GitHub</p>
 
-<p>Current version: <a href="{{ c.url }}" title="Download for {{ c.token }}">{{ c.version }}</a></p>
+<p>Current version: <a href="{{ c.url | escape }}" title="Download for {{ c.token | escape }}">{{ c.version | escape }}</a></p>
 
 {%- if c.depends_on.size > 0 -%}
     {%- include casks.html casks=c.depends_on.cask description="Depends on casks" -%}
@@ -40,7 +40,7 @@
     {%- if c.depends_on.macos -%}
         {%- capture requirements -%}
             macOS {% for x in c.depends_on.macos -%}
-                {{ x.first | xml_escape }} <strong>{{ c.depends_on.macos[x.first] | join: "</strong> / <strong>" }}</strong>
+                {{ x.first | escape }} <strong>{{ c.depends_on.macos[x.first] | join: "</strong> / <strong>" }}</strong>
                 {%- unless forloop.last %} and {% endunless -%}
             {%- endfor -%}
         {%- endcapture -%}
@@ -50,20 +50,14 @@
             {%- assign requirements = requirements | append: ", " -%}
         {%- endif -%}
         {%- capture requirements -%}
-            {{ requirements }}{% for a in c.depends_on.arch -%}
+            {{ requirements | escape }}{% for a in c.depends_on.arch -%}
                 <strong>{{ a.type | capitalize }} {{ a.bits }}-bit</strong>
                 {%- unless forloop.last %} or {% endunless -%}
             {%- endfor %} architecture
         {%- endcapture -%}
     {%- endif -%}
-    {%- if c.depends_on.x11 -%}
-        {%- if requirements.size > 0 -%}
-            {%- assign requirements = requirements | append: ", " -%}
-        {%- endif -%}
-        {%- capture requirements -%}{{ requirements }}<strong><a href="{{ site.baseurl }}/cask/xquartz">X11</a></strong>{%- endcapture -%}
-    {%- endif -%}
     {%- if requirements.size > 0 %}
-<p>Requires: {{ requirements }}</p>
+<p>Requires: {{ requirements | escape }}</p>
     {%- endif -%}
 {%- endif -%}
 
@@ -79,7 +73,7 @@
 &nbsp;&nbsp;&nbsp;&nbsp;{% endcapture %}
 <table class="full-width">
     <tr>
-        <td>{{ c.caveats | xml_escape | replace: soft_indent, hard_indent | strip | newline_to_br }}</td>
+        <td>{{ c.caveats | escape | replace: soft_indent, hard_indent | strip | newline_to_br }}</td>
     </tr>
 </table>
 {%- endif %}
@@ -110,9 +104,9 @@
                 {%- assign subsequent = true -%}
             </td>
             <td>
-                <a href="{{ variation[1].url | default: c.url }}"
-                   title="Download for {{ c.token }} on {{ variation[0] }}">
-                    {{ variation[1].version | default: c.version }}
+                <a href="{{ variation[1].url | default: c.url | escape }}"
+                   title="Download for {{ c.token | escape }} on {{ variation[0] }}">
+                    {{ variation[1].version | default: c.version | escape }}
                 </a>
             </td>
         </tr>
@@ -131,9 +125,9 @@
                 {%- assign subsequent = true -%}
             </td>
             <td>
-                <a href="{{ variation[1].url | default: c.url }}"
-                   title="Download for {{ c.token }} on {{ variation[0] }}">
-                    {{ variation[1].version | default: c.version }}
+                <a href="{{ variation[1].url | default: c.url | escape }}"
+                   title="Download for {{ c.token | escape }} on {{ variation[0] }}">
+                    {{ variation[1].version | default: c.version | escape }}
                 </a>
             </td>
         </tr>
@@ -150,12 +144,12 @@
     </tr>
     {%- for fa in site.data.analytics.cask-install.homebrew-cask[interval.path].formulae[token] -%}
     <tr>
-        <td><code>{{ fa.cask }}</code></td>
+        <td><code>{{ fa.cask | escape }}</code></td>
         <td class="number-data">{{ fa.count }}</td>
     </tr>
     {%- else -%}
     <tr>
-        <td><code>{{ token }}</code></td>
+        <td><code>{{ token | escape }}</code></td>
         <td class="number-data">0</td>
     </tr>
     {%- endfor -%}
diff --git a/_layouts/formula.html b/_layouts/formula.html
index 88d0f70eb953..25fa694f35c7 100644
--- a/_layouts/formula.html
+++ b/_layouts/formula.html
@@ -7,11 +7,11 @@
 {%- assign data_name = full_name | remove: "@" | remove: "." | replace: "+", "_" -%}
 {%- assign f = site.data[formula_path][data_name] -%}
 <h2
-    {%- if f.disabled %} class="disabled" title="This formula has been disabled since {{ f.disable_date }} because it {{ f.disable_reason }}"
-    {%- elsif f.deprecated %} class="deprecated" title="This formula has been deprecated since {{ f.deprecation_date }} because it {{ f.deprecation_reason }}"
+    {%- if f.disabled %} class="disabled" title="This formula has been disabled since {{ f.disable_date | escape }} because it {{ f.disable_reason | escape }}"
+    {%- elsif f.deprecated %} class="deprecated" title="This formula has been deprecated since {{ f.deprecation_date | escape }} because it {{ f.deprecation_reason | escape }}"
     {%- endif -%}
     >
-    {{ f.name }}
+    {{ f.name | escape }}
     {%- if f.disabled %} (disabled)
     {%- elsif f.deprecated %} (deprecated)
     {%- endif -%}
@@ -19,20 +19,30 @@
 
 {%- include install_command.html item=f.name %}
 {%- if f.aliases.size > 0 %}
-<p class="aliases">Also known as: <strong>{{ f.aliases | join: "</strong>, <strong>" }}</strong></p>
+<p class="aliases">Also known as:
+    {%- for alias in f.aliases -%}
+        <strong>{{ alias | escape }}</strong>
+        {%- unless forloop.last -%}, {% endunless -%}
+    {%- endfor %}
+</p>
 {%- endif -%}
 {%- if f.oldname %}
-<p class="oldname">Formerly known as: <strong>{{ f.oldname }}</strong></p>
+<p class="oldname">Formerly known as: <strong>{{ f.oldname | escape }}</strong></p>
 {%- endif %}
-<p class="desc">{{ f.desc | xml_escape }}</p>
-<p class="homepage"><a href="{{ f.homepage }}">{{ f.homepage }}</a></p>
+<p class="desc">{{ f.desc | escape }}</p>
+<p class="homepage"><a href="{{ f.homepage | escape }}">{{ f.homepage | escape }}</a></p>
 {%- if f.license.size > 0 %}
-<p>License: <strong>{{ f.license | join: "</strong>, <strong>" | replace: "_", " " }}</strong></p>
+<p>License:
+    {%- for license in f.license -%}
+        <strong>{{ license | replace: "_", " " | escape }}</strong>
+        {%- unless forloop.last -%}, {% endunless -%}
+    {%- endfor %}
+</p>
 {%- endif %}
 
-<p>Formula JSON API: <a href="{{ site.baseurl }}/api/{{ formula_path }}/{{ f.name }}.json"><code>/api/{{ formula_path }}/{{ f.name }}.json</code></a></p>
+<p>Formula JSON API: <a href="{{ site.baseurl }}/api/{{ formula_path }}/{{ f.name | uri_escape }}.json"><code>/api/{{ formula_path }}/{{ f.name | escape }}.json</code></a></p>
 
-<p>Formula code: <a target="_blank" href="{{ site.taps.core.remote }}/blob/{{ f.tap_git_head }}/{{ f.ruby_source_path }}"><code>{{ f.name }}.rb</code></a> on GitHub</p>
+<p>Formula code: <a target="_blank" href="{{ site.taps.core.remote }}/blob/{{ f.tap_git_head | url_encode }}/{{ f.ruby_source_path | uri_escape }}"><code>{{ f.name | escape }}.rb</code></a> on GitHub</p>
 
 <p>Bottle (binary package)
 {%- assign bottles = false -%}
@@ -95,13 +105,13 @@
     <tr>
         <td><strong>stable</strong></td>
         <td>✅</td>
-        <td>{{ f.versions.stable }}</td>
+        <td>{{ f.versions.stable | escape }}</td>
     </tr>
 {%- if f.versions.head %}
     <tr>
         <td><strong>head</strong></td>
         <td>⚡️</td>
-        <td>{{ f.versions.head }}</td>
+        <td>{{ f.versions.head | escape }}</td>
     </tr>
 {%- endif %}
 </table>
@@ -121,8 +131,8 @@
 <table>
     {%- for o in f.options -%}
     <tr>
-        <td>{{ o.option }}</td>
-        <td>{{ o.description }}</td>
+        <td>{{ o.option | escape }}</td>
+        <td>{{ o.description | escape }}</td>
     </tr>
     {%- endfor %}
 </table>
@@ -140,34 +150,34 @@
         {%- capture requirement -%}
             {%- case r.name -%}
                 {%- when "arch" -%}
-                    {{ r.version }}
+                    {{ r.version | escape }}
                 {%- when "macos" or "maximum_macos" -%}
                     macOS
                 {%- when "osxfuse" -%}
                     FUSE
                 {%- else -%}
-                    {{ r.name | capitalize }}
+                    {{ r.name | capitalize | escape }}
             {%- endcase -%}
         {%- endcapture -%}
         {%- if r.cask and formula_path == "formula" -%}
             {%- unless r.cask contains "/" -%}
-                <a href="{{ site.baseurl }}/cask/{{ r.cask }}">{{ requirement }}</a>
+                <a href="{{ site.baseurl }}/cask/{{ r.cask | uri_escape }}">{{ requirement | escape }}</a>
             {%- else -%}
-                {{ requirement }}
+                {{ requirement | escape }}
             {%- endunless -%}
         {%- else -%}
-            {{ requirement }}
+            {{ requirement | escape }}
         {%- endif -%}
     </strong>
         {%- if r.version -%}
             {%- if r.name == "arch" %} architecture
-            {%- elsif r.name contains "maximum" %} &lt;= {{ r.version }}
-            {%- else %} &gt;= {{ r.version }}
+            {%- elsif r.name contains "maximum" %} &lt;= {{ r.version | escape }}
+            {%- else %} &gt;= {{ r.version | escape }}
             {%- endif -%}
         {%- endif -%}
         {%- for c in r.contexts -%}
             {%- if forloop.first %} ( {%- endif -%}
-            {{ c }}
+            {{ c | escape }}
             {%- unless forloop.last -%}, {% endunless -%}
             {%- if forloop.last -%} ) {%- endif -%}
         {%- endfor -%}
@@ -179,7 +189,7 @@
 {%- if f.conflicts_with.size > 0 %}
 <p>Conflicts with:
     {%- for c in f.conflicts_with %}
-        <strong><a href="{{ site.baseurl }}/{{ formula_path }}/{{ c }}">{{ c }}</a></strong>
+        <strong><a href="{{ site.baseurl }}/{{ formula_path }}/{{ c | uri_escape }}">{{ c | escape }}</a></strong>
         {%- unless forloop.last -%}, {% endunless -%}
     {%- endfor %}
 </p>
@@ -192,7 +202,7 @@
 &nbsp;&nbsp;&nbsp;&nbsp;{% endcapture %}
 <table class="full-width">
     <tr>
-        <td>{{ f.caveats | xml_escape | replace: soft_indent, hard_indent | strip | newline_to_br }}</td>
+        <td>{{ f.caveats | escape | replace: soft_indent, hard_indent | strip | newline_to_br }}</td>
     </tr>
 </table>
 {%- endif -%}
@@ -214,7 +224,7 @@
     </tr>
     {%- else -%}
     <tr>
-        <td><code>{{ full_name }}</code></td>
+        <td><code>{{ full_name | escape }}</code></td>
         <td class="number-data">0</td>
     </tr>
     {%- endfor -%}