You could move the sanitation to the front end securely, it would just need to be right before render (after fetching the data to the browser). Some UI libraries do this automatically (like React) and the dompurify can run in the browser for this task.
It could have done a better job outlining how to do it properly
It could have done a better job outlining how to do it properly