Escaping
By default, Jade encodes HTML characters for security, so:
Jade |
HTML |
---|---|
- html_content = "Hello <em>World</em>" p= html_content | <p>Hello <em>World</em></p> |
And, of course:
Jade |
HTML |
---|---|
- html_content = "Hello <em>World</em>" p #{html_content} | <p>Hello <em>World</em></p> |
This is great for preventing cross-site scripting (XSS) attacks, and even just displaying innocent code examples without needing to encode them yourself. However, it will mess up content that is supposed to be HTML, such as the text provided by most content management systems. So, we need a way of telling Jade (as illustrated in the following code) when it shouldn't escape our text:
Jade |
HTML |
---|---|
- html_content = "Hello <em>World</em>" p!= html_content | <p>Hello <em>World</em></p> |
And:
Jade |
HTML |
---|---|
- html_content = "Hello <em>World</em>" p !{html_content} | <p>Hello <em>... |