Template Security & Auto-Escaping

# Auto-escaping in action
# If user_input = '<script>alert("XSS")</script>'

# SAFE — auto-escaped (default)
# {{ user_input }}
# Output: &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;
# Displays as text, does NOT execute

# DANGEROUS — escaping disabled
# {{ user_input|safe }}
# Output: <script>alert("XSS")</script>
# Executes the JavaScript! XSS attack!

# Block-level control
# {% autoescape off %}
#   {{ trusted_html }}  <- Not escaped
# {% endautoescape %}

# In Python — mark trusted content as safe
# from django.utils.safestring import mark_safe
# def get_badge(self):
#     return mark_safe('<span class="badge">Admin</span>')

# RULE: Never use |safe on user input!
# Only use it for content YOU generate (icons, badges, etc.)