Escaping

Kiln escapes everything you output with {{ }}, so data can't break your HTML or inject scripts. Text outside the delimiters is never escaped.

<p>{{ comment }}</p>

<p>&lt;script&gt;alert(&#39;hi&#39;)&lt;/script&gt;</p>

Output trusted HTML

If a value is HTML you trust, such as rich text from your own editor, mark it safe with raw:

<article>{{ body|raw }}</article>

<article><p>Hello <strong>world</strong></p></article>

Text filters such as upper, replace and truncate keep safe markup safe, so {{ body|raw|upper }} changes only the text and leaves the tags alone. Other filters return plain values, which are escaped again, so put raw after them. See String filters.

Never use raw on data from visitors. Functions and filters you write can also return safe HTML. See Safe markup and classes.

Strategies

The default strategy, html, is right for page content and quoted attributes. Other places need other rules. Use the escape filter to pick one:

<a href="/search?q={{ query|escape("url") }}">Search</a>

<a href="/search?q=tea%20%26%20cake">Search</a>

To change the strategy for a whole section, use the autoescape tag. To change it everywhere, use the autoescape option.

Safe markup

Some things produce markup that is already safe, so Kiln doesn't escape it again:

• the raw and escape filters;
• set blocks, macros, include, component, block() and parent();
• the nl2br filter and the attrs function;
• values your own code marks with safe().

JSON in scripts

The json filter escapes characters that could close a script tag, so its output is safe inside <script> with raw:

<script type="application/ld+json">{{ schema|json|raw }}</script>

<script type="application/ld+json">{"@type":"Article","headline":"\u003c/script\u003e is escaped"}</script>