3 ms·
> 20ms with Jinja2 without auto-escaping could this performance improvement back-fire if you end up with a security issue? I'm not saying that it definitely w
by gingerlime 14y ago
> 20ms with Jinja2 without auto-escaping
could this performance improvement back-fire if you end up with a security issue?
I'm not saying that it definitely would. If you know what you're doing / trust your data sources or sanitize them elsewhere, you should be fine. I'd be careful turning off such a feature completely though...
- Daishiman 14y agoOf course. This is merely a tradeoff between performance and developer time. 99% of projects will never have HTML autoescaping as a performance pain point. Then again, you're going to need tens of hours to review all templates to make sure you're escaping everything. If your hardware budget is greated than what it costs to audit the code, it's the proper decision.