> However, you have to escape and sanitize output explicitly, which is not a thing in pretty much any modern templating language. Idk if it has to with "modern

> However, you have to escape and sanitize output explicitly, which is not a thing in pretty much any modern templating language. Idk if it has to with "modern" or not. Proper escaping contexts (whether, and which delimiters to quote in attributes, in content, in markup declarations, ...) are already defined by SGML, with HTML-aware templating or other vocabulary-specific expansion such as suppressing <script> elements injection as would be required by basic user commenting also being covered by SGML. My impression was that go/templating (and maybe pug?), while considered advanced relative to other templating packages shitting strings into markup, still requires explicit sanitation depending on the insertion context.