) and every user in that chat room has been
compromised.</p>
<p>In general, you should prefer using components if you are wrapping
content in HTML. However, if you really want to include a mix of HTML
and values from models in what you return from the helper, make sure you
escape anything that may have come from an untrusted user with the
<code>escapeExpression</code> utility:</p>
<div class="filename javascript"><div class="ribbon"></div><span>app/helpers/make-bold.js</span><pre class="language-javascript 