Automatic HTML escaping
When generating HTML from templates, there's always a risk that a variable will include characters that affect the resulting HTML. For example, consider this template fragment:
Hello, {{ name }}.
At first, this seems like a harmless way to display a user's name, but consider what would happen if the user entered his name as this:
<script>alert('hello')</script>
With this name value, the template would be rendered as:
Hello, <script>alert('hello')</script>
... which means the browser would pop-up a JavaScript alert box! Similarly, what if the name contained a '<' symbol, like this?
<b>username
That would result in a rendered template like this:
Hello, <b>username
... which, in turn, would result in the remainder of the Web page ...
Get Mastering Django: Core now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
