When should I use escape and safe in Django's template system?

If I have a box where people put comments, and then I display that comment like this...should I escape?

{{ c.title }}

Actually, it depends. Django's templating engine does escaping automatically, so you don't really need to escape.

If you add template filter "safe" like {{c.title|safe}} then you do need to worry about things like html injection, because "safe" marks the string as such and it means that it won't be escaped.

There is also an {% autoescape on %}...{% endautoescape %} template tag, where "on" can be changed to "off", if necessary. By default it's on and the tag is not needed.

Other template engines may not be escaping by default, Jinja2 is one of them.

HTML auto-escaping is on by default, so you don't need to manually escape in most cases, but not all!

Dumping the contents of a variable inside an HTML element is fine:

<p>{{ variable }}</p>

Django will automatically escape the characters <, >, &, " and ', which is what is needed here.

It's also OK to dump a variable inside an attribute, since " and ' are both escaped, but make sure you remember to include quotes, as spaces are not escaped:

<span class="{{ variable }}">...</span> <!-- Good -->
<span class={{ variable }}>...</span>   <!-- Bad -->

If you want to use a string inside inline Javascript, you must use the escapejs filter, and don't forget the quotes. This protects against both escaping out of the quotes for the Javascript variable, and escaping out of the <script> tag using </script>:

<script>
   var value = "{{ variable|escapejs }}";
</script>

Yes! What if they entered <script>alert('boom');</script> as the title?

Django autoescape makes this much easier.

Auto-escaping is on by default in django templates, so you don't need to use escape. Safe is used when you want to turn it off and let the template rendering system know that your date is safe in an un-escaped form. See the django docs for details:

• Automatic HTML escaping