I know it's unlikely that wikipedia has a page whose title is <script> stealAllYourUserData();</script>, but in general it's bad practice to append html to the DOM which is just added together like that.

```
t = Handlebars.compile("<li><a href='https://en.wikipedia.org/wiki/{{title}}'>{{title}}</li>");
$("#titles").append(t({title: value})
```