AFAIK Go template library parses HTML and applies appropriate escaping depending on context. I think that most sane HTML template libraries will do at least HTM

AFAIK Go template library parses HTML and applies appropriate escaping depending on context. I think that most sane HTML template libraries will do at least HTML escaping by default. Dynamic CSS and JS usually rare so you can pay extra attention.