Is jungo autostart safe?

Question

I want to display some html in django 1.0 templates and do this, I was doing something like this:

{% autoescape off %}{{ var.text }}{% endautoescape %}

and I'm just wondering how safe this is? Am I still protected from SQL injection and crossite scripting and other vulnerabilities?

=== Edit =======

This text will come from users, so what is the best way to display html in a django template safely?

Answer 1

Autoescape , sql- ( , ). autoescape off , , "", , (.. , ). , , .

Answer 2

, HTML , , .

, (, ) ,

{% autoescape off %}
    {{ var.text }}
{% endautoescape %}

to

{{ var.text|safe }}   

Answer 3

Regardless of whether it is safe or not, it completely depends on where var.text came from. If this is an advertising message (for example) that is completely under your control, then you are safe until you shoot in the foot. If var.text somehow came from the user, then you are in danger.