apply style guide
escape template variables

unescaped ones can lead to xss