Let template mechanism escape HTML
Escape underscorejs templates

Use <%- … %> instead of <%= %> to render text.