Template Engines ¶
The main concern with template engines is what escaping they can do to prevent Cross-Site Scripting (XSS).
Warning:
None of the template engines examined here do enough escaping to prevent XSS when user-supplied data is used in unquoted HTML attributes. So...
Always quote your HTML attributes!
| Name | Autoescaping Mechanism? | Autoescaping on by default? |
|---|---|---|
| Chameleon | ? | ? |
| Django Templating | Yes | Yes, in >= 1.0 |
| Genshi | Yes | ? |
| Jinja | Yes | No |
| Mako | Yes | No |
-
Wiki content is available under a Creative Commons 3.0 License.
