> Use template literals for templating, so you don't even need handlebars/mustache anymore.

Are you using some template tag function that handles escaping? Seems risky to rely on manual escaping everywhere.