let username = <script>alert('You\'ve been HACKED!')</script>

<span>Hello, my name is \escape(username)</span>