Escaping and Special Characters (e.g. &)

If I put <script>alert('hello');</script> in the title of a WordPress page with the default theme the script runs. This is expected behaviour. HTML is typically allowed in titles in WordPress. The standard WordPress function, the_title(), does not escape the title.

If you don’t want to allow script tags then you need to sanitize the input to strip out any unwanted tags when the post is saved. WordPress already does for users that don’t have the unfiltered_html capability. It does it by using the wp_kses_post() function (note that this function is too slow to use for escaping on the front-end).

If you only want to remove HTML tags, but not encode any other characters, then you should use the strip_tags() function. It looks like you use this in Twig with striptags:

{{ some_html|striptags }}