Currently the render(string) BIF writes the contents to the output stream and returns an empty string.
An optional flag can be added, which will prevent the rendered value from being written to the response stream, and instead will return the value as a result, changing the signature to:
render(string) will work as it does now, but calling
render(string, true) will return the evaluated string as a return value.
JIRA ticket: https://luceeserver.atlassian.net/browse/LDEV-1338
WARNING: Calling render() on user-supplied input (Form, URL, etc.) is extremely dangerous and should be avoided.