Developers · Liquid

Liquid Sanitization

Last updated 7 November 2026

When you display data, from user input or from external sources, it is important to sanitize output before displaying it on a website to avoid XSS attacks. In Liquid on Insites, we escape every variable output when you use and markups.

Input

{% assign user_name = '<a href="https://www.insites.io">Click Me</a>' %}

<h2>{{ user_name }}</h2>

Output (not processed by the browser)

<h2>&lt;a href=&quot;https://www.insites.io&quot;&gt;Click Me&lt;/a&gt;</h2>

In this case HTML tags are not processed by the browser, so the link is not a clickable link.

Disable Variable Sanitization

In situations when you want to display content as it is you can use html_safe to specify that this variable can be printed without sanitization.

To build JSON output, do not add html_safe to values by hand. Put the values in a hash and print it with the json filter. The filter quotes and escapes every value, so the result is valid JSON.

Input

{% assign color = "red" %}
{% assign link = '<a href="/car">cars</a>' %}
{% assign data = { "color": color, "link": link } %}
{{ data | json }}

Escape Variables Before Passing them to External Systems

You can also run HTML/JavaScript sanitization on variables before passing them to tags/filters: