Template output is not universally auto-escaped. Treat request values, custom model results and external data as untrusted.<\/p>\n
For ordinary text and quoted HTML attributes, escape at the output:<\/p>\n
<p>{{ q.search|escape }}<\/p>\n<input name="search" value="{{ q.search|escape }}">\n<\/code><\/pre>\nRequest values can also have unexpected structured shapes. For resource lookups, resolve a scalar identifier and use m.rsc[value].id<\/code>; do not trust arbitrary request data as a resource object. Check authorization on the server before reading private data or changing a resource.<\/p>\nPersisted resource properties normally pass through Zotonic's resource sanitization. This allows intentional rich text such as id.body<\/code> to render as HTML. That does not make every custom model, raw database value or import option safe. Do not apply an HTML-stripping bypass to untrusted content.<\/p>\nJavaScript, CSS and URLs require their own handling. Prefer generated element IDs and the {% javascript %}<\/code> pipeline instead of interpolating text into scripts. Use a JSON encoder when sending JSON. HTML escaping alone cannot prevent an unsafe URL scheme; accept only the schemes and destinations your feature supports.<\/p>\nTest a literal <script><\/code> string, quotes, ampersands, unexpected list\/map input and a javascript:<\/code> URL at each relevant boundary. Expect text to stay text and invalid input to be rejected. A CSP is an additional boundary, not a replacement for correct encoding and validation.<\/p>\nDisplay values safely<\/h2>\n
Resource properties read through m.rsc<\/code> follow Zotonic's content handling. Query arguments and values returned by custom models do not automatically have the same guarantees.<\/p>\nEscape plain text from those sources:<\/p>\n
<p>{{ q.term|escape }}<\/p>\n<\/code><\/pre>\nDo not mark arbitrary user input as safe HTML. Decide at the model or content boundary whether a field contains text, sanitized HTML, a URL, or another type. Keep that decision consistent across templates and API responses.<\/p>\n
When a value renders unexpectedly, inspect its type and translation behavior before applying more filters. See filter#escape<\/code><\/a>, Expose data through a model<\/a>, and Keep permission checks at the boundary<\/a>.<\/p>"}},"slug":"render-template-values-safely","is_protected":false,"visible_for":0,"tz":"UTC","language":["en"],"is_featured":false,"content_group_id":{"id":339,"is_a":["meta","content_group"],"name":"default_content_group","title":{"_type":"trans","tr":{"en":"Default Content Group"}},"uri":"https:\/\/zotonic.com\/id\/default_content_group"},"category_id":{"id":318,"is_a":["meta","category"],"name":"cookbook","title":{"_type":"trans","tr":{"en":"Cookbook"}},"uri":"https:\/\/test.zotonic.com\/id\/318"},"publication_start":"2022-09-08T19:06:00Z","is_website_redirect":false,"pivot_location_lng":null,"name":null,"is_unfindable":false,"is_published":true,"doc_editorial_edges":{"depiction":[],"hasreference":[1461,1536],"subject":[2554]},"summary":{"_type":"trans","tr":{"en":"Choose escaping for the value and the output context."}},"pivot_geocode":null,"custom_slug":false,"created":"2022-09-08T19:06:30Z","uri":null,"date_is_all_day":false,"is_dependent":false,"is_page_path_multiple":false,"publication_end":"9999-08-17T12:00:00Z","modifier_id":{"id":1,"is_a":["person"],"name":"administrator","title":"Site Administrator","uri":"https:\/\/zotonic.com\/id\/1"},"privacy":0,"doc_editorial_bundle":true,"creator_id":{"id":1,"is_a":["person"],"name":"administrator","title":"Site Administrator","uri":"https:\/\/zotonic.com\/id\/1"},"seo_noindex":false,"modified":"2026-10-07T11:13:53Z","title_slug":{"_type":"trans","tr":{"en":"render-template-values-safely"}}},"uri":"https:\/\/zotonic.com\/id\/2325","uri_template":"https:\/\/zotonic.com\/id\/:id","websub":{"hub":"https:\/\/zotonic.com\/.zotonic\/websub","topic":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/2325"}},"status":"ok"}