+4  A: 

Yes, {{ myobject.content | escape }} should help (assuming you mean Django templates -- there's no specific "App Engine" templating system, GAE apps often use the Django templating system); you may need to repeat the | escape part if you want two levels of escaping (as appears to be the case in some but not all of the example you supply).

Alex Martelli
My small app is using Google's webapp framework. But I think that framework does default to using the Django template system.
Jim
You're correct, it does.
Nick Johnson
+2  A: 

This is Django's django.utils.html.escape function:

def escape(html):
    """Returns the given HTML with ampersands, quotes and carets encoded."""
    return mark_safe(force_unicode(html).replace('&', '&amp;').replace('<', '&l
t;').replace('>', '&gt;').replace('"', '&quot;').replace("'", '&#39;'))

Also, see here.

T Banes