C25_L4></a></span></code></pre></div>
<p>Now the value passed into the helper has its HTML escaped, but the trusted
<code>&lt;b&gt;</code> tags that we want to wrap the value in are <em>not</em> escaped. A
malicious user setting their <code>firstName</code> to something containing HTML
would see this:</p>
<pre class="language-handlebars line-numbers"><code class="handlebars language-handlebars">Welcome back! <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>b</span><