You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/filter_reference.md
+24-12Lines changed: 24 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -514,17 +514,17 @@ Escape special characters in a string for safe use in HTML.
514
514
515
515
This filter replaces the characters `&`, `<`, `>`, `'`, and `"` with their corresponding HTML-safe sequences:
516
516
517
-
- `&` -> `&`
518
-
- `<` -> `<`
519
-
- `>` -> `>`
520
-
- `'` -> `'`
521
-
- `"` -> `"`
517
+
-`&` -> `&`
518
+
-`<` -> `<`
519
+
-`>` -> `>`
520
+
-`'` -> `'`
521
+
-`"` -> `"`
522
522
523
523
This helps prevent HTML injection (XSS) when rendering untrusted content in HTML element bodies or attributes.
524
524
525
-
TODO: important
525
+
!!! warning
526
526
527
-
Important: This filter does **not** make strings safe for use in JavaScript, including in `<script>` blocks, inline event handler attributes (e.g. `onerror`), or other JavaScript contexts. For those cases, use the `escapejs` filter instead.
527
+
This filter does **not** make strings safe for use in JavaScript, including in `<script>` blocks, inline event handler attributes (e.g. `onerror`), or other JavaScript contexts. For those cases, use the [`escapejs`](#escapejs) filter instead.
528
528
529
529
```liquid2
530
530
{{ "Have you read 'James & the Giant Peach'?" | escape }}
@@ -536,19 +536,31 @@ Have you read 'James & the Giant Peach'?
536
536
537
537
## escapejs
538
538
539
+
```
540
+
<string> | escapejs
541
+
```
542
+
539
543
Escape characters for safe use in JavaScript string literals.
540
544
541
545
This filter escapes a string for embedding inside **JavaScript string literals**, using either single or double quotes (e.g. `'...'` or `"..."`). It replaces control characters and potentially dangerous symbols with their corresponding Unicode escape sequences.
This filter does **not** make strings safe for use in JavaScript template literals (backtick strings), or in raw JavaScript expressions. Use it only when placing data inside quoted JS strings within inline `<script>` blocks or event handlers.
544
555
545
-
**Important:** This filter does **not** make strings safe for use in JavaScript template literals (backtick strings), or in raw JavaScript expressions. Use it only when placing data inside quoted JS strings within inline `<script>` blocks or event handlers.
556
+
TODO: point to JSON filter
546
557
547
-
TODO: point to JSON filter
558
+
**Recommended alternatives:**
548
559
549
-
**Recommended alternatives:** - Pass data using HTML `data-*` attributes and read them in JS via `element.dataset`. - For structured data, prefer a JSON-serialization approach....
560
+
- Pass data using HTML `data-*` attributes and read them in JS via `element.dataset`.
561
+
- For structured data, prefer a JSON-serialization approach....
550
562
551
-
Escaped characters include: - ASCII control characters (U+0000 to U+001F) - Characters like quotes, angle brackets, ampersands, equals signs - Line/paragraph separators (U+2028, U+2029)
0 commit comments