Where the html string come from?
If you are writing your view, then use m('p', ...) instead of m.trust
For example, if only the "person" value is dynamic, you should have something like:
window.WhoAmI = {}
WhoAmI.controller = function(attr) {
var ctrl = this
ctrl.gender = m.prop(attr.gender)
}
WhoAmI.view = function(ctrl) {
return m('p', [
'I am a ',
m('code',
ctrl.gender()
)
])
}
If you get the whole html string from a request, then it's probably a bad thing, and you should try to rewrite your API (if possible) to send only the dynamic value to the client.