jinja2: html escape variables

Question

how do I html-escape dangerous unsanitized input in jinja2?

Can I do it inside the template or must it be done in python code?

I have a variable that may contain da<ngero>u&s chars. How do I escape it in jinja2

Answer 1

e.g.

{{ user.username|e }}

Pipe it through the |e filter

Jinija: Template Designer Documentation -> Builtin Filters: Escape

Answer 2

You could also tell the environment to autoescape everything:

e = Environment(loader=fileloader, autoescape=True)

note: in jinja1 this is auto_escape