Why and when to use the Django mark_safe () function

Question

After reading the document, mark_safe () still seems like a myth. I think this is due to CSRF. But why and when should mark_safe () be used?

Here is the documentation

mark_safe [source] ¶

Explicitly mark the string as safe for (HTML) output. The returned object can be used throughout the string or unicode.

It can be called several times on the same line.

To create HTML snippets, you usually should use django.utils.html.format_html ().

A line marked safely will become unsafe again if changed. For example:

Answer 1

Django - , "" . , , .

php python:

PHP:

<? echo $foo ?>

:

<script src="evil">

:

{{ foo }}

:

>script src="evil"<

, <a href="link">text</a>. django , <> . , , mark_safe, , (.. userinput).

{{ foo|safe }} {% autoescape off %}{{ foo }}{% endautoescape %} django, , ​​.

, mark_safe ? templatetags , python, , {{foo | mylinkifyfunction}} (.. URL- foo, <a href=""></a> URL-).