How are variables in "<p>{text}</p>" replaced? Is the security of it just an implementation detail left to the programmer who use it? Safe way would be finding the P and then doing p.textContent = data. But how do you find element by value efficiently? Or do you just to text replace?