How do I html-escape dangerous unsanitized input in jinja2?
escaping, jinja2, python, security
Solution
e.g.
{{ user.username|e }}
Pipe it through the `|e` filter
Docs:
- 2.x: Jinja: Template Designer Documentation -> HTML Escaping
- 3.x: Jinja: Template Designer Documentation -> HTML Escaping
Problem
Can I do it inside the template or must it be done in python code? I have a variable that may contain da<ngero>u&s chars. How do I escape it in jinja2?