Autoescaping and the safe Filter
Stay XSS-safe and opt out only when sure.
Autoescaping and the safe Filter is a free Flask Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Flask Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Danger of Raw HTML
If you print user text straight into a page, a sneaky input could inject scripts. This attack is called XSS, and Flask defends against it.
Autoescaping Is On
By default Jinja2 turns on autoescaping for HTML templates. Dangerous characters get neutralized before they reach the browser.
What Escaping Does
Escaping converts characters like the less-than sign into safe entities. The browser then shows them as text, never as live markup.
<b>hi</b> becomes <b>hi</b>Why Text Stays Text
Because tags are escaped, a comment like a fake bold tag shows up as plain text. The page renders it literally instead of running it.
When You Trust the HTML
Sometimes you truly want HTML rendered, like a value you built yourself. For that you can opt out with the safe filter.
{{ trusted_html|safe }}How safe Works
The safe filter tells Jinja2 this value is already trusted, so do not escape it. The markup then renders as real HTML.
Only on Trusted Data
Use safe only on content you control. Marking user input safe reopens the very XSS hole autoescaping was closing.
Marking Safe in Python
You can also flag trusted HTML in your view with Markup. A Markup string skips escaping automatically when rendered.
from markupsafe import Markup
snippet = Markup('<b>Hi</b>')Disabling Escaping Locally
To skip escaping for a whole region, wrap it in an autoescape block set to false. Use this rarely and with great care.
{% autoescape false %}{{ html }}{% endautoescape %}The escape Filter
You can also force escaping with the escape filter, or its short alias e. It is handy when autoescaping is off for a block.
{{ value|e }}Safe by Default
The big idea: Flask is secure out of the box. You only relax escaping deliberately, never by accident, which keeps users protected.
Quick Check
You print untrusted user input in a template. What does autoescaping do with HTML tags in it?
Recap
You learned Flask autoescapes output to block XSS, and that the safe filter opts out only for HTML you fully trust. Stay secure! 🔒
Frequently asked questions
Is the “Autoescaping and the safe Filter” lesson free?
Yes — the full text of “Autoescaping and the safe Filter” is free to read here on the web, and the Flask Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Flask Academy course, upgrade to CoddyKit PRO.
What will I learn in “Autoescaping and the safe Filter”?
Stay XSS-safe and opt out only when sure. You practise Flask Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Flask Academy?
No prior experience is required. Flask Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Autoescaping and the safe Filter” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Flask Academy lesson?
Yes. Every Flask Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- render_template and the templates Folder
- Pass Data into a Template
- Jinja2 Loops and Conditionals
- Autoescaping and the safe Filter