"probably" makes it sound like we're unsure about the situation in general. I think it should say something like:

"Yes, **however** they must be handled very carefully because there is a lot of potential for [cross-site scripting attacks](https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29) when working with user-supplied strings."