Handlebars triple-stash to avoid escaping html entities

Question

I use handlebars, and if an escaped character such as ' is processed it is rendered on screen as '.

I know wrapping the var

Answer 1

By default all double-stashed {{var}} embeds in Handlebars will be HTML-escaped. It's performed for security reasons to avoid DOM XSS vulnerabilities. Because your variable may contain any data including user-data or any kind of untrusted data.

In some cases you will need to embed your data as-is, without escaping. There is where tripple-stash {{{var}}} used. But every time doing this, you need to think what may be in your data and can you trust it?

Read more about HTML Escaping on Handlebars site.