Added _underscore, and used its templating with escaped vars for user input.