In your phtml template file you need to output a URL inside a JavaScript context. var url = ''; Which two methods allow you to keep the output XSS-safe?