I know it's not very probably here, but still, I would close the arbitrary strings into h() to prevent XSS