Escape

They turn into tags.

Then you need to escape the escape sequence.

But what if you want to literally have a backslash?

Here I have our rule for beginning the tokenization of JavaScript.

Benny's not here. I think he went AWOL.

On the left is what you'd have to say to Python and on the right is what it means.

By this means, options can be made to have different settings in different parts of theBy this means, options can be made to have different settings in different parts of the pattern.

Escape response

That's going to be anything that's not a double quote or a backslash.

Do I trust the user?

We may have a dot and to really mean the dot,

This is the basis for cross site scripting.

That gets put here. Jinja has a syntax called safe.

Heredoc text behaves just like a double quoted string, without the double quotes.

And, here's one thing to look out for.

But the nicest way to fix this is through a method called Escaping hence, the title of this page.

Why is that?

Okay. And this is what we get

Any regular expression starts with r' or r .

All of this looks like 3 characters. It's really just 2.

Actually what we did is we allowed links and image, and then we broke all other HTML.

Now we can check for that, and there's a couple of ways to go around this.

That's pretty simple.

As it turns out, this function is already included in Python cgi.escape (s, quote True)

If I were to view the source of this file, which you can do in Chrome easily, we can see what happened.

The only thing you really have to keep in mind is you have to escape characters that are particular to a regular expression.

Here is the input that doesn't work properly.

If we were to look at the source for this page, you can see what we typed in has all been escaped using HTML escaping, which is not exactly what we intended.

This basically when you accept data from a user, and you're displaying it in your webpage, and you're not escaping it.

It's called a text area, and it's another form element for entering large pieces of text.

Okay, I'm going to submit this.

Where have those six got to? They've escaped.

It inherits some base HTML, and it redefines the content block to basically render one blog.

It's either escaped like we have here or it's just a character by itself all the other letters.

And, as you can see, it works just the same hello, amp blah, blah, blah, blah blah.

Those characters can be in 2 groups.

If you escape your HTML, you don't have to worry about it.

I can use these escape sequences to literally write down a special character.

Instead of including a ( ), we convert it to ( amp quot ) and we can also Escape angled brackets.

Where will you turn? You must live ...

If I didn't have this safe here, Jinja 2 would automatically because of the way I configured it when we set it up would escape everything.

In some sense, the first character I want to match is this Less Than sign but just in case that has special meaning for regular expressions,

A comment begins with the slash and the star, which is indicated right here.

We've got no and then it ends.