How does AnQiCMS handle special characters in the generated content of the `lorem` tag?

As an experienced website operation expert, I know that how to efficiently and safely handle various contents in a content management system is the key to ensuring the normal operation of the website and the user experience, especially for those contents that may contain 'special characters'. Today, let's delve into how AnQiCMS handlesloremHow to ensure that everything is natural, smooth, and safe when generating special characters in label content.

How AnQiCMS ensuresloremLabel generation content special characters are correct?

At the stage of website development and content testing, we often need a large amount of placeholder text to fill in the page layout and check the style effects. AnQiCMS provides a very convenientloremTags that can help us quickly generate random text in the style of “Lorem Ipsum”. The strength of this tag is that it can not only generate plain text, but also generate text containing HTML tags (such as<p>Paragraph structure text.Then, how does AnQiCMS handle common special characters in the generated content, such as punctuation marks, even simulated HTML tags?

loremLabel: Flexible tool for content generation

First, let's take a look back atloremBasic usage of label. It allows us to generate random text in various ways:

• Plain text word: {% lorem 10 w %}10 random words will be generated.
• Plain text paragraph: {% lorem %}or{% lorem 100 w %}English will generate a text with specified length.
• HTML Paragraph: {% lorem 3 p %}English will generate 3 packages in<p>tags paragraph.
• Randomness:还可以添加random参数以增加文本的随机性。

无论是哪种生成方式，loremThe text generated by the label will contain various special characters from natural languages, such as commas, periods, quotes, colons, semicolons, and so on. And when we usep参数时，它还会生成 HTML 的段落标签。

AnQiCMS 模板引擎的“安全卫士”——自动转义机制

The template engine design of AnQiCMS considers content security issues from the fundamental level. It incorporates a powerfulAutomatic HTML escaping mechanism, which is exactly for processingloremThe core of special characters in labels and all template outputs.

In simple terms, when the template engine renders the output of any variable or tag to the HTML page, it will by default escape special characters that may be parsed as HTML structure or executed as JavaScript code by the browser. For example,<will be escaped as<,>will be escaped as>,"will be escaped as"autoThis default escaping behavior is a 'security defense' of AnQiCMS, which effectively prevents cross-site scripting attacks (XSS), ensures the purity and security of the website content, and avoids the injection of malicious code.

loremLabel Content Special Character Handling in Practice

Understood the automatic escaping mechanism, let's take a look atloremThe specific handling method of the generated content of the tag is very clear:

1. Generate plain text (withoutp参数）：When you use{% lorem 10 w %}or{% lorem 100 w %}The period, comma, quotation marks, and other punctuation symbols contained in the plain text generated, as they do not belong to HTML tags or entities, AnQiCMS template engine will output them directly.The browser will treat it as plain text and display it as expected.In this case, no additional escaping is required because the content is plain text.

2. 生成 HTML 段落（带)p参数）：这是最值得关注的场景。如果您使用{% lorem 3 p %}生成包含 HTML<p>The label paragraph, at this time the automatic escaping mechanism of AnQiCMS will take effect.

   • Default case (not explicitly declared)|safe):If you directly putloremThe output of the label is printed to the template, for example{{% lorem 3 p %}}The template engine will default toloremgeneratedall contentto be escaped. This means, includingloremthe label itself generated<p>Label, will also be escaped<p>and</p>The result is, the browser will not parse it as an HTML paragraph, but will display it as a literal meaning<p>...</p>Text. This is usually not the expected result.
   • Expected result (explicitly stated)|safe):In order toloremThe HTML paragraph generated by the tag can be correctly parsed and rendered by the browser, and we need to explicitly tell the AnQiCMS template engine that this part of the content is 'safe' HTML and does not need to be automatically escaped. This is where|safefilter. For example:

     
     {% lorem 3 p %}|safe
     

     Add it.|safeAfter, the template engine will skip the HTML escaping of this part of the content, and directly willlorem标签生成的<p>...</p>Output to the page, and the browser can render the paragraph correctly according to the standard HTML rules.

WhyloremDoes the tag itself need special "processing" for special characters?

the key is,loremThe tag itself is a contentGeneratorIt is responsible for generating text according to predefined rules. It does not handle thesafety processingThe rendering and security guarantee are the responsibilities of AnQiCMS template engine. This design of separation of responsibilities is very reasonable:loremFocused on providing flexible placeholder content, while the template engine handles the output security of all content uniformly.loremThe tag itself does not刻意 go through“processing”special characters when generating text; it simply generates text with standard punctuation or HTML structure, and the security and rendering work are completed by the template engine.

Summary

AnQiCMS Through its powerful template engine and the default automatic HTML escaping mechanism, generates content includingloremThe content generated by the label provides solid security guarantees. ForloremThe plain text generated by the label, in which punctuation marks will be displayed naturally. And forloremLabel-generated HTML paragraph, you need to decide whether to use it according to actual requirements|safeFilter. If you want the browser to parse the generated HTML structure correctly, you must add|safeFilter.Otherwise, for security reasons, the template engine will default to escaping all HTML tags into literal text.This mechanism balances development efficiency, flexibility, and the most important website security.

---

Common Questions (FAQ)

1.loremWhy is the generated HTML content of the label not rendered as expected but displayed instead?<p>What about the text of tags like this?This is usually because you are using{% lorem 3 p %}When generating HTML paragraphs, there was no addition at the end of the output|safeFilter. AnQiCMS template engine, for security reasons, will default to escaping all output HTML tags and displaying them as<p>English. In order for the browser to correctly parse and render these HTML structures, you need to addloremafter the output of the|safefor example{% lorem 3 p %}|safe.

2. BesidesloremTags, all content output through variables in AnQiCMS needs to be added manually|safe?Not all content needs to be included.AnQiCMS template engine defaults to automatically escaping the output content of all variables, which is an important security mechanism.Ensure the content source is secure and reliable, and the browser should parse and render it as original HTML codethen you need to explicitly add it|safeFilter. For general text or content where you are unsure of its safety, it is recommended to keep the default automatic escaping to prevent XSS attacks.

3. If IloremLabel generated text containing quotes, will AnQiCMS handle it extra?WhenloremLabel generation containing quotes (for example'or"）of plain text, the AnQiCMS template engine will default to outputting it directly as plain text to the HTML page. Only when these quotes appear in contexts that may be interpreted as HTML attribute values or JavaScript code, and you have not used|safeThe filter converts them to'or"HTML entities, to ensure the correct and safe display of the page. Usually, there is no need to worry in plain text display scenarios.