Default HTML escaping vs triple-stache with external sanitization for user content
A Handlebars.js template set needs to render content that may include characters such as & and < as well as a limited set of allowed markup from a data source. The documented behavior is that {{ }} escapes HTML entities by default to prevent XSS, while {{{ }}} bypasses escaping and outputs raw HTML. The design constraint is consistent rendering across
handlebars