You need to use something that represents the HTML tree using real data types.  I do a lot of my work in Scheme, where we have SXML:<p><pre><code>    &#x27;(p &quot;hello&quot; (strong &quot;jamespo&quot;))
</code></pre>
Before you say &quot;ahhh the parens!&quot;, there are special readers such as Racket&#x27;s Pollen that provide a less Lispy, but still powerful, language for writing documents.<p>For JavaScript, there&#x27;s of course a bunch of options such as Mithril:<p><pre><code>    m(&quot;p&quot;, [&quot;hello&quot;, m(&quot;strong&quot;, &quot;jamespo&quot;)]);
</code></pre>
I don&#x27;t write Go so I don&#x27;t know what the options are there.  Just trying to raise awareness for safer programming.<p>For much more in-depth information about the problem, see: <a href="http:&#x2F;&#x2F;www.more-magic.net&#x2F;posts&#x2F;structurally-fixing-injection-bugs.html" rel="nofollow">http:&#x2F;&#x2F;www.more-magic.net&#x2F;posts&#x2F;structurally-fixing-injectio...</a>