[alex-robbins]

In the context of this article, it's worth pointing out that hiccup doesn't escape strings automatically. Rum does, and I've been using it as a drop-in replacement:

    user> (require '[rum.core :as rum]
                   '[hiccup.core :as hiccup])
    nil
    user> (rum/render-static-markup [:p "<script>alert('you have been pwned')</script>"])
    "<p>&lt;script&gt;alert(&#x27;you have been pwned&#x27;)&lt;/script&gt;</p>"
    user> (hiccup/html [:p "<script>alert('you have been pwned')</script>"])
    "<p><script>alert('you have been pwned')</script></p>"

(Note that Rum is also a React wrapper, but you don't have to use that part of it; you can simply use it for static rendering of HTML.)

https://github.com/tonsky/rum