So Outside Technology Security CMS
AnQiCMS
Online Demonstration

What are the differences and usage scenarios between the `escape` filter and the `e` filter in AnQiCMS?

Calendar 👁️ 66

In the development of Anqi CMS templates, we often encounter the need to handle the security of content display, especially when the content may contain user input or be obtained from external sources.This is particularly important to escape special characters to prevent potential cross-site scripting (XSS) attacks.AnQi CMS providedescapeandeThese filters help us handle such problems, their functions are completely the same,ejustescapeAbbreviation of one.

Then, what is the purpose of these two filters, and when should we use them?

escapeandeThe core role of the filter

escapeandeThe main task of the filter is to escape the special HTML characters in the string. Specifically, they will convert the following five characters to their corresponding HTML entities:

  • <to&lt;
  • >to&gt;
  • &to&amp;
  • "to&quot;
  • 'to&#39;

The purpose of this escaping is to ensure that these characters are interpreted as literal text in the browser and not as HTML tags, attributes, or executable scripts. For example, if you have a string that is<script>alert('XSS');</script>Afterescapeoreprocessed, it will become&lt;script&gt;alert(&#39;XSS&#39;);&lt;/script&gt;This way, the browser will not execute this JavaScript code when rendering the page, but will display it as plain text, thereby effectively preventing XSS attacks.

The default security mechanism of AnQi CMS

The template engine of AnQi CMS was designed with security in mind. By default, all content that is{{ 变量 }}output in the form to the page will beAutomatic escapingThis means that even if your variable contains<script>such HTML tags, the system will default to converting them into&lt;script&gt;etc. entities without the need for manual additionescapeorefilter.

This default behavior greatly simplifies the work of template developers and ensures the output security of the website.In most cases, you directly output the text content obtained from the database or users, and the system will automatically escape it, saving you a lot of trouble.

when you need to use them explicitlyescapeoreFilter?

Although AnQi CMS defaults to automatically escaping output content, in certain specific scenarios, you still need to understand and may explicitly use itescapeoreFilter:

  1. Manual补救 after disabling automatic escaping: Anqi CMS provides{% autoescape off %}Label, allows you to turn off the default automatic escaping feature in a specific block of the template.This is usually used when you need to output a segment of content containing HTML tags, and you are confident that the HTML content is safe and does not require escaping (for example, from a trusted source of rich text content).However, if in{% autoescape off %}within the block, you need to output somewhich should have been escaped(for example, content from untrusted user input), you must explicitly useescapeoreThe filter is used to manually enforce escaping. For example: “`twig {% autoescape off %}

    This content includes safe HTML tags, so I disabled automatic escaping.

    User submitted comment

Related articles

How does AnQiCMS template escape HTML to prevent XSS attacks when displaying user submitted content?

In today's network environment, website security is of great concern to operators, among which cross-site scripting attacks (XSS) are one of the common security threats.XSS attacks inject malicious scripts into web pages, steal user data, alter page content, and even control user sessions.AnQiCMS as a content management system that focuses on security, built a series of powerful HTML escaping mechanisms to effectively prevent such attacks when processing user submitted content and displaying it in templates.

2025-11-08

What are the potential uses of the `safe` filter in AnQiCMS besides displaying HTML?

In AnQi CMS template engine, the default automatic escaping mechanism is an important security feature, which can convert special characters in HTML tags and JS scripts (such as `<`, `>`, `&`, etc.) to corresponding HTML entities, thereby effectively preventing cross-site scripting (XSS) attacks.However, in certain specific content output scenarios, we indeed need to allow the browser to parse and render the HTML or similar HTML code as it is, at which point the `safe` filter becomes crucial.

2025-11-08

How to prevent AnQiCMS template from automatically escaping HTML tags and output the original content directly?

When using AnQiCMS to build a website and design a template, you may encounter a common problem: when outputting some content in the template, the tags that were originally expected to be displayed as HTML are automatically converted to plain text, for example, `<p>This is a paragraph</p>` becomes `&lt;p&gt;This is a paragraph&lt;/p&gt;`.This loses the original style and structure of the content.Understanding this problem and knowing how to handle it is very important for template developers.Why does the AnQiCMS template automatically escape HTML tags?

2025-11-08

How to call and safely display the `Content` field that contains HTML on the AnQiCMS document detail page?

On a website built with AnQiCMS, the core of the document detail page is often the main content of the article, namely the `Content` field.This field carries a wealth of information, ranging from simple text to complex text and image layouts, multimedia embedding, and even custom code segments.Therefore, how to correctly and safely display these contents containing HTML format in the template is a key skill that every AnQiCMS user needs to master.AnQiCMS when designing template rendering, fully considers the security of the content.

2025-11-08

How to handle JavaScript code output containing special characters (such as `&lt;script&gt;`) in AnQiCMS?

In website operation, we sometimes need to output custom JavaScript code on the page, which may be to implement specific interactive functions, integrate third-party service scripts (such as statistical codes, advertising codes), or add some dynamic effects to the page.However, when these JavaScript codes themselves contain some special characters, especially HTML tags (such as `<script>`), if not handled correctly, it may cause the page to display abnormally, disable functions, or even bring serious security vulnerabilities.

2025-11-08

How to control the automatic escaping of HTML content with the `autoescape` tag in AnQiCMS templates?

In AnQiCMS template development, for the safety of the website, the system defaults to automatically escaping all HTML content output to the page. This means that when you directly output a variable containing special HTML characters in the template, for example, `<script>alert('XSS')</script>`, AnQiCMS will convert it to `&lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;`

2025-11-08

How does AnQiCMS automatically convert URLs and email addresses in plain text to clickable HTML links?

In website content creation, we often need to mention URLs and email addresses in articles, descriptions, or comments.If this information is just plain text, users cannot directly click to jump, which undoubtedly affects user experience and the efficiency of information transmission.AnQiCMS as an efficient content management system fully considers this requirement and built-in smart functions can automatically convert URLs and email addresses in plain text to clickable HTML links.

2025-11-08

What are the differences between the `urlize` and `urlizetrunc` filters in converting URLs to links?

In Anqi CMS, when processing text content, we often need to automatically convert the URLs or email addresses contained within into clickable links.This not only improves the user experience, but also helps search engines better understand the content of the page.Therefore, AnQi CMS provides two very practical filters: `urlize` and `urlizetrunc`.Their core function is to intelligently convert URLs and email addresses in text to the HTML `<a>` tag, but there are key differences in specific application scenarios and effects.

2025-11-08