Échappement automatique et filtre safe

If you print user text straight into a page, a sneaky input could inject scripts. This attack is called XSS, and Flask defends against it.

By default Jinja2 turns on autoescaping for HTML templates. Dangerous characters get neutralized before they reach the browser.

Escaping converts characters like the less-than sign into safe entities. The browser then shows them as text, never as live markup.

Because tags are escaped, a comment like a fake bold tag shows up as plain text. The page renders it literally instead of running it.

Sometimes you truly want HTML rendered, like a value you built yourself. For that you can opt out with the safe filter.

The safe filter tells Jinja2 this value is already trusted, so do not escape it. The markup then renders as real HTML.

Use safe only on content you control. Marking user input safe reopens the very XSS hole autoescaping was closing.

You can also flag trusted HTML in your view with Markup. A Markup string skips escaping automatically when rendered.

To skip escaping for a whole region, wrap it in an autoescape block set to false. Use this rarely and with great care.

You can also force escaping with the escape filter, or its short alias e. It is handy when autoescaping is off for a block.

The big idea: Flask is secure out of the box. You only relax escaping deliberately, never by accident, which keeps users protected.

You print untrusted user input in a template. What does autoescaping do with HTML tags in it?

You learned Flask autoescapes output to block XSS, and that the safe filter opts out only for HTML you fully trust. Stay secure! 🔒