HTML templates

Canonical guidance

• use html/template for HTML
• rely on autoescaping by default
• pass explicit data to templates

Use when

• server-rendered pages
• email HTML generation with trusted boundaries
• embedded or filesystem-backed template sets

Avoid

• text/template for HTML pages
• concatenating raw HTML strings in handlers
• turning off safety with trusted types casually

Preferred pattern

• parse templates once, execute with a typed view-model value

Anti-pattern

• building HTML with fmt.Sprintf and string concatenation

Explanation: This is tempting for small pages, but it drops escaping guarantees and quickly becomes unmaintainable.

Why

• HTML generation is a security boundary as much as a rendering concern