Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I html-escape dangerous unsanitized input in jinja2?

Can I do it inside the template or must it be done in python code?

I have a variable that may contain da<ngero>u&s chars. How do I escape it in jinja2?

like image 575
flybywire Avatar asked Oct 12 '09 20:10

flybywire


People also ask

How do you escape jinja2?

To escape jinja2 syntax in a jinja2 template with Python Flask, we can put render the template code without interpretation by putting the code in the {% raw %} block.

Does Jinja escape HTML?

Jinja provides a feature that can be enabled to escape HTML syntax in rendered templates.

What is jinja2 syntax?

Jinja, also commonly referred to as "Jinja2" to specify the newest release version, is a Python template engine used to create HTML, XML or other markup formats that are returned to the user via an HTTP response.


1 Answers

e.g.

{{ user.username|e }} 

Pipe it through the |e filter

Jinja: Template Designer Documentation -> HTML Escaping

like image 98
jitter Avatar answered Sep 22 '22 12:09

jitter