Description
The solution is using this kind of render array as a return value
Array
(
[0] => Array
(
[#markup] => Drupal\Core\Render\Markup Object
(
[string:protected] => anime & manga
)
)
)
Putting the value in #markup prevents HTML filtering, while having the Markup Object there prevents XSS filtering on the string. In code, use something like:
<?php
$elements[$delta] = ['#markup' => \Drupal\Core\Render\Markup::create($label)];
This was used in a field formatter but it can likely go in any preprocess hook too.
Notes
- Thanks to sir Beni