Corrected example using variable type `template.HTML`

Added a variable for the `template.HTML` XSS example.