Python&#x27;s Jinja templating language has the concept of &quot;safe&quot; and &quot;unsafe&quot; strings. By default all strings are unsafe (meaning they will be escaped wherever they are rendered) and you need to explicitly mark them as safe in order to be able to treat them as HTML.<p>React and Angular (and maybe Ember too?) similarly auto-escape any strings to be rendered and only provide very explicit ways to circumvent that (in React it&#x27;s even called &quot;dangerouslySetInnerHTML&quot; and takes an object with a property called &quot;__html&quot; rather than a string[0]).<p>You can avoid XSS in dynamically typed languages. You just need to make it easier to do the safe thing than the difficult thing.<p>[0]: I really like React&#x27;s approach to naming APIs you should think twice about using. For legacy reasons ReactDOM is still bundled as part of React and exposed with a property but the name of that property is &quot;__SECRET_DOM_DO_NOT_USE_OR_YOU_WILL_BE_FIRED&quot; (presumably to prevent React maintainers &#x2F; Facebook employees from using it).