Autoescaping and the safe Filter
Stay XSS-safe and opt out only when sure.
The Danger of Raw HTML
If you print user text straight into a page, a sneaky input could inject scripts. This attack is called XSS, and Flask defends against it.
Autoescaping Is On
By default Jinja2 turns on autoescaping for HTML templates. Dangerous characters get neutralized before they reach the browser.
All lessons in this course
- render_template and the templates Folder
- Pass Data into a Template
- Jinja2 Loops and Conditionals
- Autoescaping and the safe Filter