Skip to content

Commit

Permalink
emphasizing the need of autoescaping
Browse files Browse the repository at this point in the history
  • Loading branch information
stefanw committed Mar 28, 2010
1 parent 3579561 commit e01a54d
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions README.mkd
Expand Up @@ -28,7 +28,7 @@ Round 2: Take cached template and lazily include referenced template:
{% lazyinclude "evil_template.html" %}
...</html>

Since the " of evil_user_input are autoescaped to &amp;quot;
the fake lazyinclude tag gets not recognised by the regex.
Since the " of output_of_user_input are autoescaped (you got autoescaping, don't you?) to &amp;quot;
the fake lazyinclude tag isn't recognised by the regex.

When the LazyIncludeMiddleware is not detected, the lazyinclude template tag will act like a normal include tag.

0 comments on commit e01a54d

Please sign in to comment.