Comment by schemescape

I didn’t see anything about escaping values going into template literals. Did I miss it?

That seems important for anything involving user input.

Edit: Escaping rules also differ on context (HTML, attribute, URIs, script tags, etc.), so it’s not trivial.