and this leads to html injection attacks when there are small errors in your escaping.

Using a template engine means you systematically ensure that values are escaped (at least, that's one of the reasons i would choose an engine over raw dogging the html).