{# WRONG: a hand-rolled escaper that handles only < and >, and a javascript: blocklist. #} Profile
{# snippet:begin render #} {# Print raw so entities stored in old profiles (é) still render, but escape < and > so no tag can be injected. #} {% set name_html = name|replace("<", "<")|replace(">", ">")|safe %} {% set bio_html = bio|replace("<", "<")|replace(">", ">")|safe %} {{ name_html }}

{{ name_html }}

{{ bio_html }}

{# snippet:end render #} {# snippet:begin url #} {# Block the scheme from the bug report. #} {% set href = "#" if website.lower().startswith("javascript:") else website %} {% if website %} Website {% endif %} {# snippet:end url #}