Skip to content

Commit 5e64ff1

Browse files
committed
Rearrange filter reference docs
1 parent 8c0f911 commit 5e64ff1

File tree

1 file changed

+24
-12
lines changed

1 file changed

+24
-12
lines changed

docs/filter_reference.md

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -514,17 +514,17 @@ Escape special characters in a string for safe use in HTML.
514514

515515
This filter replaces the characters `&`, `<`, `>`, `'`, and `"` with their corresponding HTML-safe sequences:
516516

517-
- `&` -> `&amp;`
518-
- `<` -> `&lt;`
519-
- `>` -> `&gt;`
520-
- `'` -> `&#39;`
521-
- `"` -> `&#34;`
517+
- `&` -> `&amp;`
518+
- `<` -> `&lt;`
519+
- `>` -> `&gt;`
520+
- `'` -> `&#39;`
521+
- `"` -> `&#34;`
522522

523523
This helps prevent HTML injection (XSS) when rendering untrusted content in HTML element bodies or attributes.
524524

525-
TODO: important
525+
!!! warning
526526

527-
Important: This filter does **not** make strings safe for use in JavaScript, including in `<script>` blocks, inline event handler attributes (e.g. `onerror`), or other JavaScript contexts. For those cases, use the `escapejs` filter instead.
527+
This filter does **not** make strings safe for use in JavaScript, including in `<script>` blocks, inline event handler attributes (e.g. `onerror`), or other JavaScript contexts. For those cases, use the [`escapejs`](#escapejs) filter instead.
528528

529529
```liquid2
530530
{{ "Have you read 'James & the Giant Peach'?" | escape }}
@@ -536,19 +536,31 @@ Have you read &#39;James &amp; the Giant Peach&#39;?
536536

537537
## escapejs
538538

539+
```
540+
<string> | escapejs
541+
```
542+
539543
Escape characters for safe use in JavaScript string literals.
540544

541545
This filter escapes a string for embedding inside **JavaScript string literals**, using either single or double quotes (e.g. `'...'` or `"..."`). It replaces control characters and potentially dangerous symbols with their corresponding Unicode escape sequences.
542546

543-
TODO: important
547+
Escaped characters include:
548+
549+
- ASCII control characters (U+0000 to U+001F)
550+
- Characters like quotes, angle brackets, ampersands, equals signs - Line/paragraph separators (U+2028, U+2029)
551+
552+
!!! warning
553+
554+
This filter does **not** make strings safe for use in JavaScript template literals (backtick strings), or in raw JavaScript expressions. Use it only when placing data inside quoted JS strings within inline `<script>` blocks or event handlers.
544555

545-
**Important:** This filter does **not** make strings safe for use in JavaScript template literals (backtick strings), or in raw JavaScript expressions. Use it only when placing data inside quoted JS strings within inline `<script>` blocks or event handlers.
556+
TODO: point to JSON filter
546557

547-
TODO: point to JSON filter
558+
**Recommended alternatives:**
548559

549-
**Recommended alternatives:** - Pass data using HTML `data-*` attributes and read them in JS via `element.dataset`. - For structured data, prefer a JSON-serialization approach....
560+
- Pass data using HTML `data-*` attributes and read them in JS via `element.dataset`.
561+
- For structured data, prefer a JSON-serialization approach....
550562

551-
Escaped characters include: - ASCII control characters (U+0000 to U+001F) - Characters like quotes, angle brackets, ampersands, equals signs - Line/paragraph separators (U+2028, U+2029)
563+
TODO: example
552564

553565
## escape_once
554566

0 commit comments

Comments
 (0)