#!perl -w
use strict;
use Text::Xslate;
my $tx = Text::Xslate->new(
module => ['JavaScript::Value::Escape' => [qw(js)]],
);
my %params = (
user_input => '</script><script>alert("XSS")</script>',
);
print $tx->render_string(<<'T', \%params);
<script>
document.write('<: $user_input | html | js :>');
var user_input = '<: $user_input | js :>';
</script>
T