The EJS tags you will use
Only a handful of EJS tags appear in real projects:
<%= value %>: print a value (HTML-escaped for safety).<%- value %>: print a value unescaped (risky, only with trusted HTML).<% code %>: run JavaScript (loops, conditionals).<!-- comment -->: HTML comments.
The escaped version (%=) is the default. It prevents a common web bug called cross-site scripting, where attacker input is turned into safe text instead of executable code.