you should use Utils.template instead of this internal _template function. Utils.template handles HTML escaping automatically so that's goo d:)