A good habit for Template code is escape all template vars. That way DB/User-input strings can be plain/arbitrary without risk of XSS attacks.
E.g.: <% name | html %>In reply to Re^2: CGI to Dancer popup_menu
by Your Mother
in thread CGI to Dancer popup_menu
by adriang
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |