Template strings are the preferred approach when handling user supplied text to avoid security issues.

Examples:

from string import Template

TEMPLATE='$greeting $name!'

data = {
    'greeting': 'Hello',
    'name': 'Bob'
    }

print(Template(TEMPLATE).substitute(data))

"""
    $ python3 test_str_template.py
    Hello Bob!
"""

References:

1. https://realpython.com/python-string-formatting/#4-template-strings-standard-library
2. https://docs.python.org/3/library/string.html