Generating HTML from strings rather than templates

All of those operate at compile time on compile time values. If you have code that accepts a user supplied string and evaluates it at runtime, it’s exactly the same as calling Code.eval_string, it’s wildly unsafe.