The fact that XSS isn't covered (or even mentioned!) in an article about building your own HTML templating system is a major, and dangerous, oversight