Sanitise user input before using it in the UI

We'll need to sanitise all user input before using it in the UI.

Underscore can do this by using `<%-` to render output instead of `<%=`. We still need to investigate whether this will catch all cases.