Uses html/template to prevent injection attacks