I generally agree with your overall philosophy. But I have one disagreement. String interpolation is subject to XSS, when used to generate HTML. Yes, it's possible to sanitize and escape, but you have to remember to do it every time.