How deeply does Django in Action cover HTML escaping?

Demonstrates escaping through template files, Django’s rendering engine, REPL output, and explicit safe-markup overrides.

HTML escaping

As explained in Django in Action

HTML escaping replaces characters with special meaning in HTML with representations that are displayed as text rather than interpreted as markup.

HTML escaping transforms characters with special meaning in HTML into representations displayed as text instead of interpreted as markup. Django automatically escapes template variables when templates load through the configured rendering engine. section 3.7

Test escaping in a Django template

Create a template containing “I love the sound a {{ instrument }} makes.” Rendering it with “tuba > baritone” produces “tuba > baritone.” A value such as “<b>sax</b>” becomes “<b>sax</b>,” so the tags appear as text. The Django REPL can load the file through Engine.get_default() and get_template().

Escaping is enabled by default, but trusted markup can bypass it with the safe filter or mark_safe(). format_html() creates formatted safe output; use these only when the markup is intentionally safe. section 3.7

How Django in Action covers it

liveBook manning.com

Read Django in Action on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

ASP.NET Core in Action, 3eHTML encoding is the transformation of characters in text into representations that browsers treat as literal content rather than markup or executable code.
liveBook manning.com

Learn Go with Pocket-Sized ProjectsHTML escaping transforms characters with special meaning in HTML into safe representations that are treated as text rather than markup or code.

Compare how 3 books explain HTML escaping →

Related concepts

Rawcontrasts with · Raw is a Razor HTML helper method that outputs content without applying HTML encoding.
Razor compilerused by · The Razor compiler transforms Razor files containing markup and code into generated classes or output for execution by an ASP.NET Core application.
Razor Pagesused by · Razor Pages is an ASP.NET Core page-focused programming model in which independently addressable pages combine Razor markup with request-handling logic.
Razor syntaxused by · Razor syntax is a templating syntax that combines markup with embedded .NET code and directives to generate web content.
cross-site scripting attackaddresses · Cross-site scripting is a web security vulnerability in which attacker-controlled content causes executable script to run in another user’s browser within a trusted application context.

This explainer was generated by Manning's knowledge graph from the text of Django in Action. The section links point to the parts of the book it draws on.