SafeString is a Django subclass of Python str whose contents bypass automatic HTML escaping during template rendering. It lets intended markup appear as markup instead of turning characters such as < and > into entities. section 3.7
Use SafeString with care:
- Call mark_safe() when a complete string already contains trusted HTML. section 3.7
- Use format_html() to build HTML around values; it returns a SafeString and avoids composing separate marked fragments. section 3.7
- Remember that operations on a SafeString produce ordinary str objects; mark the result safe again only when appropriate. section 3.7
- Do not disable escaping for untrusted user input, because malicious content can damage rendered pages. section 3.7
Rendering trusted instrument markup
mark_safe("drum<br/>") renders the line break as HTML. format_html("big <i>{}</i>", "bass") renders an italicized bass name while producing a SafeString for the template.
