I think that this is prone to error. At least for me, when I see a
piece of code like this one, I will definitly think that it needs to be
escaped:
<p>{{ content }}</p>
But if I'm passing something in the view code without escaping, I will
have to check the template to make sure it is being handled properly.
So I cannot do a security audit of my code just by scanning my lines of
code.
It will also make it difficult to debug errors when the tempaltes are
viewed.
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Django developers" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/django-developers
-~----------~----~----~----~------~----~------~--~---
