[Django]-Is using the "escape" tag really mandatory as a good security pattern in Django?

4👍

That version of the Django book was written well before 1.0 came out, and is significantly out of date. All template content has been autoescaped for quite some time now.

2👍

In django is been done automatically. To turn it off you have to use the autoescape tag. I’m not sure since when, but at least since 1.1 version.

{% autoescape off %}
  safe stuff
{% endautoscape %}

Leave a comment