Put some work to come with a much more sane template engine based on raw PHP code. The new engine sanitizes all variables by default until the user explicitlu calls the unescape method.