Liquid Sanitization

When you display data, from user input or from external sources, it is important to sanitize output before displaying it on a website to avoid XSS attacks. In Liquid on Insites, we escape every variable output when you use and markups.

Input

Output (not processed by the browser)

In this case HTML tags are not processed by the browser, so the link is not a clickable link.

Disable Variable Sanitization

In situations when you want to display content as it is you can use html_safe to specify that this variable can be printed without sanitization.

To build JSON output, do not add html_safe to values by hand. Put the values in a hash and print it with the json filter. The filter quotes and escapes every value, so the result is valid JSON.

Input

Escape Variables Before Passing them to External Systems

You can also run HTML/JavaScript sanitization on variables before passing them to tags/filters:

• escape_javascript
• raw_escape_string
• sanitize