Django Template--html Escape

--HTML escape

# will include HTML tags output, not interpreted execution, because when the user commits the # string, may contain some offensive code, such as JS script;

--Automatically escaped characters in Django

# < will be converted to &lt;# > converted to &gt;# ' (single quotes) will be converted to & #39; # "(double quotes) will be converted to &quot;# & will be converted to &amp;

--Use escape filter when displaying variables that are not trusted

# {{T1|escape}} omitted to write, for Django to be automatically escaped;

--Close Escape (HTML tags can be interpreted to execute)

--Use safe filter;

# {{T1|safe}}

--Use the autoescape tag for code blocks to turn off escape filter escapes;

# {% Autoescape off%}# {{T1}}# {% Endautoescape%}

--string literal value

--Literal value

# Execute in HTML page; {{t1|default: "<b>123</b>"}}# execution result is bold ' 123 ';

--Manual escape

{{t1|default: ' <b>123</b> '}} # The execution result has escaped;

Django Template--html Escape