Is using the "escape" tag really mandatory as a good security pattern in Django? -


in the security chapter of the django book, says must use template tag {% escape %} in order protect site cross-site scripting.

is necessary put escape tag on every single template string? there way specify @ application level?

that version of django book written before 1.0 came out, , out of date. template content has been autoescaped quite time now.


Comments

Popular posts from this blog

python - Scipy curvefit RuntimeError:Optimal parameters not found: Number of calls to function has reached maxfev = 1000 -

c# - How to add a new treeview at the selected node? -

java - netbeans "Please wait - classpath scanning in progress..." -