How to escape HTML in node.js EJS view?

html node.js ejs
marko picture marko · Apr 24, 2013 · Viewed 24.5k times · Source

I want to escape the html in bloglist[i].Text field. How to do that with EJS? 

<!DOCTYPE html>
<html>
  <head>
    <title><%= title %></title>
    <link rel='stylesheet' href='/stylesheets/style.css' />
  </head>
  <body>
    <h1><%= title %></h1>
    <p>Welcome to <%= title %></p>
    <% for(var i=0; i < bloglist.length; i++) { %>
       <h3> <%= bloglist[i].Title %></h3>
       <div>
          <%= bloglist[i].Text %>
       </div>
    <% } %>
  </body>
</html>

Answer

Julian Lannigan picture Julian Lannigan · Apr 24, 2013

You are escaping the value correctly by using:

<%= bloglist[i].Text %>

If you want to allow HTML to be rendered, then you want an "unescaped" value. To do that use the following:

<%- bloglist[i].Text %>

All I did was replace the equal (=) with a dash (-).

Reference: https://github.com/visionmedia/ejs/tree/0.8.3#features

Related questions

How can I use if statement in ejs?

I have a page that makes a foreach and show some photos like this <% imgs.forEach(function(img) { %> <img src="uploads/<%=user.username%>/screenshots/<%= img %>"> <% }); %> And I want make a …

Read More
How can I turn an EJS template into a string?

I want to pass my variables into that template, let it render, and then get the resulting HTML as a string. How can I do that in Express?

Read More
Loading basic HTML in Node.js

I'm trying to find out how to load and render a basic HTML file so I don't have to write code like: response.write('...<p>blahblahblah</p>...');

Read More