A <i>much</i> better way to mitigate XSS&#x2F;HTML injections is not using string functions to generate HTML.<p>CSP prevents an attacker from executing scripts, but the attacker can still corrupt your HTML.