API / Apache FreeMarker Interview questions
How does FreeMarker's auto-escaping work?
Auto-escaping automatically encodes values inserted through ${...} so that untrusted or unescaped data cannot break out of the surrounding markup - for example escaping < and & in HTML output. It is controlled per template by the output_format and auto_esc settings, typically declared at the top of the file:
<#ftl output_format="HTML"> <p>${comment.text}</p> <#-- automatically HTML-escaped -->
When auto-escaping is on, a value that is already known to be safe markup of that output format - such as the result of another FreeMarker call that also declares output_format="HTML" - is not double-escaped. The ?no_esc built-in can force a specific value to bypass escaping when it is deliberately trusted markup. This mechanism replaced the older, template-wide <#escape x as x?html> approach, which had to be applied manually and consistently by every template author.
More Related questions...