These need to be using `Y.Template` or manually escaping user input via `Y.Escape`.