Auto-Escaping & XSS

The web's #1 vulnerability: putting user data into HTML without escaping.

<p>User said: {{ comment }}</p>

If user typed: <script>alert("xss")</script>, that script runs in everyone's browser.

Auto-escape: by default, all variable output runs through HTML escape:

• < → <
• > → >
• & → &
• " → "
• ' → '

Order: & MUST be first (else < becomes <).

SafeString marker: subclass of str. Engine knows: don't escape this.

When to use | safe:

• Markdown converted to HTML by trusted lib.
• Pre-rendered partials.
• NOT for user input.

Context-aware escaping (Go's html/template):

• HTML body: HTML escape.
• HTML attribute: attribute escape.
• JS string: JavaScript escape.
• URL: percent encode.
• CSS: CSS escape.

<a href="{{ url }}">{{ link_text }}</a>
<script>var x = "{{ js_var }}";</script>

Each context has different rules. Go's templates auto-detect; Jinja2 escapes uniformly (HTML).

Modern best practice:

• Auto-escape ON by default.
• Mark trusted with safe.
• Audit safe usages — they're attack surfaces.
• Validate user input at boundary.

XSS still tops OWASP. Always auto-escape unless explicitly trusted.