markupsafe

Project Overview

MarkupSafe implements a text object that is safe to use in HTML and XML. Characters with special meanings are replaced with escaped forms so untrusted user input can be displayed on a page, mitigating injection attacks. Markup is a str subclass, and text marked safe is not escaped again — template engines like Jinja2 rely on it for automatic escaping.

Escape untrusted strings before they reach the page — the first line of template defense.

Key Features

• escape function: replaces special characters with HTML entities and wraps the result in Markup
• Markup safe marker: a str subclass that skips re-escaping when concatenated
• Operators escape too: arguments passed to Markup concatenation and formatting are escaped automatically
• html protocol: objects can provide custom safe output through an html method
• soft_str helper: converts objects to plain strings without marking them safe, preventing accidental pass-through
• Template engine foundation: Jinja2 and others build their auto-escaping on top of it

Target Audience

• Web template and framework developers
• Backend engineers assembling HTML fragments directly
• Teams building content publishing or CMS systems
• App developers who must render user input safely

Quick Start

1. Install

pip install MarkupSafe

2. Escape untrusted text

from markupsafe import escape, Markup

escape('<script>alert(1)</script>')
Markup('<strong>Hi</strong>')

3. Most projects install it implicitly, as Jinja2 and Flask pull it in automatically

Core Advantages

• Safe by default: escaping happens at concatenation and formatting time, closing gaps
• Clear semantics: the Markup type makes it obvious which content is already safe
• Lightweight and proven: a single responsibility, long validated by mainstream template engines

System Requirements

Notes

• Not an HTML sanitizer: it only escapes characters; rich-text whitelist filtering needs a dedicated sanitizer
• Use Markup carefully: wrapping untrusted content in Markup bypasses escaping, only mark text you know is safe