If I have a box where people put comments, and then I display that comment like this...should I escape?
{{ c.title }}
views:
46answers:
3
+1
A:
Yes! What if they entered <script>alert('boom');</script> as the title?
Django autoescape makes this much easier.
brool
2010-10-30 01:49:04
So, I should escape? What about "safe"?
TIMEX
2010-10-30 02:21:59
+3
A:
Actually, it depends. Django's templating engine does escaping automatically, so you don't really need to escape.
If you add template filter "safe" like {{c.title|safe}} then you do need to worry about things like html injection, because "safe" marks the string as such and it means that it won't be escaped.
There is also an {% autoescape on %}...{% endautoescape %} template tag, where "on" can be changed to "off", if necessary. By default it's on and the tag is not needed.
Other template engines may not be escaping by default, Jinja2 is one of them.
Evgeny
2010-10-30 03:26:37
What's the difference between {{ c.title }} and {{ c.title|escape }}, if Django does auto escaping already?
TIMEX
2010-10-30 21:32:40
You can always control the autoescaping with: {% autoescape on %} {{ body }}{% endautoescape %}Here the escape filter could be used to escape selectively
zsquare
2010-10-31 07:25:17
+1
A:
Auto-escaping is on by default in django templates, so you don't need to use escape. Safe is used when you want to turn it off and let the template rendering system know that your date is safe in an un-escaped form. See the django docs for details:
ars
2010-10-30 03:31:12