This is passing untrusted data directly to the template. Cast it to a bool in someway and this will be good.