[1lint]

Ah okay I see now you were referring to failure to sanitize inputs/outputs in the original comment. I don't know if this oversight occurs more often when using string templating, but I'm pretty sure this was already a problem long before string templating came into practice.

[yencabulator]

It's literally the reason why HTML templating is done with other means than string concatenation, these days.