This will generate: `<div id="map" class=event-map></div>`. Notice the missing quotes, the first step in becoming vulnerable to a script injection attack.

You should have an `if` block around the `div` and remove it entirely if there's no map to show.