template('foo#{bar}baz. a #{b|another b}', { bar: 'BAR', b: null }); // fooBARbaz, a another b

apply_template.js

applyTemplate = (function() {
	var markup = /#\{([^|}]+)(?:\|(.*?)\|)?\}/g;
	return function(t, o, escape) {
		return (!t || !o) ?
			t :
			t.replace(markup, function(_, prop, alt) {
				prop = o[prop];
				if (!prop && prop !== '' && prop !== 0)
					prop = alt || '';
				return escape ? prop.escapeTag() : prop;
			});
	};
})();

apply_template.spec.js

// JSSpec describe
describe('global functions', {
	'applyTemplate': function() {
		var str = 'foo#{bar}baz';
		var obj = { bar: 'BAR' };
		value_of(applyTemplate(str, obj)).should_be('fooBARbaz');

		var str = 'foo#{bar}baz';
		var obj = { bar: '<a href="&xss&">BAR</a>' };
		value_of(applyTemplate(str, obj)).should_be('foo<a href="&xss&">BAR</a>baz');
		value_of(applyTemplate(str, obj, true)).should_be('foo&lt;a href=&quot;&amp;xss&amp;&quot;&gt;BAR&lt;/a&gt;baz');

		var str = '1#{1},2#{2},3#{3},4#{4},5#{5},6#{6}';
		var obj = {
			1: null,
			2: 0,
			3: '',
			4: NaN,
			5: false,
			6: undefined
		};
		value_of(applyTemplate(str, obj)).should_be('1,20,3,4,5,6');

		var str = 'foo#{bar|(no bar)|}baz';
		var obj = {};
		value_of(applyTemplate(str, obj)).should_be('foo(no bar)baz');

		var str = 'foo#{bar| {not} supported |}baz#{bar|BAR|}';
		var obj = {};
		value_of(applyTemplate(str, obj)).should_be('foo {not} supported bazBAR');

		var str = 'foo#{bar||}baz#{bar||B|A|R||}';
		var obj = {};
		value_of(applyTemplate(str, obj)).should_be('foobaz|B|A|R|');
	}
});

string.escapetag.js

String.prototype.escapeTag = function() {
	return this.toString()
		.replace(/&/g, '&')
		.replace(/"/g, '"')
		.replace(/</g, '&lt;')
		.replace(/>/g, '&gt;');
};