Comment by chii
16 hours ago
and this leads to html injection attacks when there are small errors in your escaping.
Using a template engine means you systematically ensure that values are escaped (at least, that's one of the reasons i would choose an engine over raw dogging the html).
You can have a safe library that does this and then enforce its usage with a linter or something. Template engines print strings and escape them under the hood.