If you are enamored of @if but don't like the security issues around its use of eval, you can use my alternative @if helper. It provides an attribute test="expr" to specify your if condition. eval is NOT used to evaluate the expression.
Variables in the expression are restricted to dust names and path used to access values from the context. Constants are JavaScript integer, float, hex and string forms ("xx" or 'xx'). Operands can be a "variable", a constant, or a binary or unary expression yielding a value. Relational operators are <, >, <=, >=, ==, !=. Boolean operators are ! (unary), || and &&.. Operator precedence is the same as JavaScript and parentheses are allowed for clarity or for when the precedence is not what you want.
Here is an example:
{@if test="state == 'CA' || state == 'NY'"}
true stuff goes here
{:else}
false stuff goes here
{/if}
Note that it still has code to allow the cond="expr" attribute that uses eval(). This provides a migration path for existing code.
You can install it as an npm module (https://npmjs.org/package/dustmotes-if).