We do not have any way to escape the admin-configured values.
For example, the following could be configured in Site admin -> Plugins -> Filters -> Display H5P:
I suspect that we need to do some or all of the following:
- Allow the administrator to provide the regex delimiters (currently added as a # in code)
- Test the regex on save for validity
- Improve the documentation for this setting
- Something else...