That security concern is nonsense. Use {% verbatim %} as noted below for angular templates (there's plenty of backports for Django <1.5). I have django templates fill in runtime parameters (csrf_tokens, etc) all the time.