Fill Html TemplateBuilding approval emails and HtmlService notices by concatenating strings is how < in a client name becomes a broken page — or worse…
Escape HTML for HtmlServiceStuffing sheet values straight into HtmlService HTML is how < in a client name breaks the sidebar — or worse, opens an XSS footgun…
