I generally think websites should do their processing in the backend, whenever possible. Running code to generate the website should not be the user's problem. This also comes with the advantage of not being constrained to *Script languages. C is alright, but if you're of the defeatist camp who thinks writing C safely is impossible, you can adapt the BCHS philosophy just as well to C++, Rust, Go, D, Python, AWK, Common Lisp…