<%- %> not escaping special characters

Question

I have a form where users can sign up and create an account, any special characters get saved into my mongoDB like this business: "Jack's Cereal Shack&qu