Use <%- to escape html