HTML Code

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>escape — user text</title>
</head>
<body>
  <h1>User text</h1>
  <pre id="out"></pre>
  <script src="https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js"></script>
  <script>
    var tpl = _.template(
      '<p class="msg">Welcome, <%- user %>!</p>'
    );
    document.getElementById("out").textContent =
      tpl({ user: "Sam<img onerror=alert(1)>" });
  </script>
</body>
</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

Lodash _.templateSettings.escape — user text (Try It)