If there is no Get handler the user shouldn't be able to supply arbitrary input. But new exploits are invented all the time. You should escape all data coming into your app that you didn't supply, as standard policy. And yes, you should escape all variables you print out with TT using Template's filters.

You entered: [%  sanitized_input | html_entity %]
[download]

TT still doesn't provide default filtering afaik, but HTML::Template does.