title: Express: Safest way to parse parse objects passed to ejs file:
body: <p>I am using express and suppose I want to pass the following to my ejs:</p>
  
  <p><code>evilUser = { name: "evil", passwordHash: "rememberToNotSendSecrets", evenBetter: "store secrets separately", profileText: "I like to own noob webmasters&lt;/script&gt;&lt;script&gt;window.alert(1337);&lt;/script&gt;" }</code></p>
  
  <p>Now if I <code>render</code> it on <code>index.ejs</code>, it would trigger the window alert, making it unsafe. Is there a way to pass it safely such that it all html/js attacks are removed from the object?</p>