I may be mistaken, but I&#x27;m reasonably sure with respect to XSS (in HTML templates anyway), the built-in html&#x2F;template autoescapes provided parameters by default, much as Django templates do.<p>You have to mark &quot;trusted&quot; or &quot;pre-escaped&quot; parameters explicitly by wrapping them in e.g. `template.HTML`.