markupsafe

MarkupSafe is a Python library that provides a small, well-defined API for safely handling text that will be embedded in HTML or XML contexts. It aims to prevent injection vulnerabilities by offering reliable escaping and a way to mark content as safe for rendering.

The core components of MarkupSafe are the Markup class and the escape function. Markup is a subclass of str that represents a string known to be safe for inclusion in HTML. Markup objects can be concatenated with regular strings while preserving their safe status, helping templating engines avoid double escaping. The escape function accepts a plain string and returns a new string with characters such as &, <, >, " and ' replaced by their corresponding HTML entities (for example, &amp;, &lt;, &gt;, &quot;, &#39;). This function also gracefully handles existing Markup content to maintain safety.

MarkupSafe is widely used in templating systems, most notably by Jinja2, the templating engine used by Flask and many other Python web frameworks. Jinja2 relies on MarkupSafe to manage safe vs. escaped content during template rendering, enabling efficient and correct handling of user-provided data.

The project is part of the Pallets Projects and is maintained with open-source releases on PyPI and GitHub. It is distributed under a permissive license and has seen ongoing development to improve performance, Python 3 support, and interoperability with modern templating workflows.