== Ask Yourself Whether

* Templates are used to render web content and
** dynamic variables in templates come from untrusted locations or are user-controlled inputs
** there is no local mechanism in place to sanitize or validate the inputs.

There is a risk if you answered yes to any of those questions.