Django template escaping

Question

Django templating system provides a few options (filters) for escaping contents in the html, but they are kind of confusing to me as a beginner. Say I'm following a tutorial to make a simple blog, and the blog content needs to be escaped - I trust the content because I am the only one editing it. So the question is should I do it like {{ post.content|autoescape }}, {{ post.content|escape }}, or {{ post.content|safe }} in the html?

Thanks

EDIT: Which filter should I use to have special characters converted to html entities automatically?

EDIT 2: I just realized that autoescape is not a valid filter.

Answer 1

HTML escaping is on by default in Django templates.

Autoescape is a tag. not a filter:

{% autoescape on %}
    {{ post.content }}
{% endautoescape %}

The 'escape' filter escapes a string's HTML. Specifically, it makes these replacements:

• < is converted to <
• > is converted to >
• ' (single quote) is converted to '
• " (double quote) is converted to "
• & is converted to &

The 'force_escape' is almost identical to 'escape' except for a few corner cases.

The 'safe' filter will mark your content as safe, so it won't be escaped (will be sent to browser as is).

Which filter should I use to have special characters converted to html entities automatically?

Well, you mean, like converting Ã to Ã? Stick with utf-8 encoding all the way and forget about those.

Answer 2

first of all, you should escape your content because you never know (even if you are the one who enter the data) if you are going to need special character (like <, >, ).

The syntax you use show you are uncomfortable with the use of escaping :

this

{% autoescape on %}
    {{ content }}
{% endautoescape %}

is exactly the same as this

{{ content|escape }}

this

{{ content }}

is exactly the same as this <-- edit : If the autoescape is OFF (thanks to Paulo Scardine)

{{ content|safe }} 

Safe is use like that :

{% autoescape on %}
    {{ content }}  <-- escape
    {{ content|safe }}  <-- not escape
{% endautoescape %}

Answer 3

Your question shows you are a little confused about what escaping is.

Escaping is turning non-safe characters - like HTML tags - into escaped versions so that malicious content such as script tags don't ruin your site. Django does this by default on all content rendered in a template from a variable.

It seems by your comment that you're the only one editing your content that what you want is to render your variables without the automatic escaping. So, for that, you need to mark it as safe. You can either do this in the template, by either wrapping the whole lot in {% autoescape off %}...{% endautoescape %} tags or via the {{ myvar|safe }} filter on individual variables. Or, you can do it in the view, by calling mark_safe(myvar) on individual variables before passing them to the template.

Answer 4

To avoid escaping use "safe" (https://docs.djangoproject.com/en/dev/ref/templates/builtins/?from=olddocs#safe):

Marks a string as not requiring further HTML escaping prior to output. When autoescaping is off, this filter has no effect.

To escape use "escape" (https://docs.djangoproject.com/en/dev/ref/templates/builtins/?from=olddocs#escape):

Escapes a string's HTML.