Is using the "escape" tag really mandatory as a good security template in Django?

Question

In the security chapter of Django Book , he says that I should always use a template tag {% escape %}to protect my site from cross-site scripting.

Do I really need to put an escape tag on every line of the template? Is there any way to indicate this at the application level?

Answer 1

This version of the Django book was written long before the release of 1.0 and is significantly outdated. All template content has been auto-exploited for quite some time.

Answer 2

django . , autoescape. , , , 1.1.

{% autoescape off %}
  safe stuff
{% endautoscape %}