This is a potential XSS. I noticed this a lot in the old oneboxes as well. I think switching to handlebars is smart, since it will prevent most XSS. But if you put values inside tags, you don't need < and > to XSS. I agree that in the case of wikipedia it might be a tad bit farfetched that I can inject in the image url, but on other sites this is quite feasible. Please consider adding an encode_quotes helper, or in cases like this where they're not needed, just strip them.