ejs has systems to escape. You can have the whole string escaped by using an equal sign: `<%= your text %>`, or a helper `escape` is always available in ejs context.