We need to be VERY careful about opening up ourselves to script injection attacks with template building. Is there a way we can restructure the data being passed in to avoid needing to build templates with strings? At the very least, I think we should HTML escape the key.