> i wouldnt really use t() because its slow and people forget that this code is vulnerable to XSS. 

We should solve this the other way around: Let Jenkins perform a few checks on the translations and block translations containing other tags than:

  - `<b>`
  - `<a>` << check for on-handler + javascript here
  - .. ?

@DeepDiver1975 Is that possible? - If yes we should start a new issue here to discuss which things we should allow and which things we should block - now it's just too easy for a potential attacker to join a translation team and to potential bad things ;-)
\cc @karlitschek