Why and When to use Django mark_safe() function

Django is a framework, which tries to do "the right" thing by default. This means when you do the most simple thing, you're propably doing the right thing.

Now let's look at some template in php and python:

PHP:

<? echo $foo ?>

May give:

<script src="evil">

Django:

{{ foo }}

Gives with the same input:

>script src="evil"<

Now assume, you want to place a link <a href="link">text</a>. Then django will render it as text using <> again. If you know what you're doing, you can now use mark_safe to indicate that the text is trusted (i.e. not coming from userinput).

Usually you will use {{ foo|safe }} or {% autoescape off %}{{ foo }}{% endautoescape %} in your templates as django programmer, which is more clear when the string is declared as being safe.

So, where is mark_safe used? When you write own templatetags or filters, then you need to mark the string as safe from python, because the developer will assume, that {{ foo|mylinkifyfunction }} does the right thing (i.e. it escapes the url foo, but does not escape the <a href=""></a> around the url).

It's also worth noting that when building HTML code fragments it's advised to use format_html(...) function instead of mark_safe and escaping all its arguments.

So, instead of writing:

mark_safe("%s <b>%s</b> %s" % (
    some_html,
    escape(some_text),
    escape(some_other_text),
))

You should instead use:

format_html("{} <b>{}</b> {}",
    mark_safe(some_html),
    some_text,
    some_other_text,
)

This has the advantage that you don’t need to apply escape() to each argument and risk a bug and an XSS vulnerability if you forget one.