# CKEditor - turn off autoescaping judiciously for Javascript?

**URL:** <https://forum.djangoproject.com/t/ckeditor-turn-off-autoescaping-judiciously-for-javascript/4322>\
**Category:** Using Django\
**Created:** [September 12, 2020, 10:41pm UTC](https://forum.djangoproject.com/t/ckeditor-turn-off-autoescaping-judiciously-for-javascript/4322 "2020-09-12T22:41:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon36149362](https://avatars.discourse-cdn.com/v4/letter/a/bc8723/32.png) [@anon36149362](https://forum.djangoproject.com/u/anon36149362)\
**Post date:** [September 12, 2020, 10:41pm UTC](https://forum.djangoproject.com/t/ckeditor-turn-off-autoescaping-judiciously-for-javascript/4322/1 "2020-09-12T22:41:55Z")

</div>

Another problem with CKEditor is that you have to turn off auto escaping in your template for it to display the HTML it has generated.

```auto
  {{article.intro|safe}}

```

However, you can then embed JavaScript directly into the fields of your model in HTML, which obviously isn’t ideal.

Any suggestions to overcome these problems? I’m starting to get cold feet on CKEditor. I like it, just don’t think it’s quite there yet.

I assume other people are using CKEditor in live apps, and wondering how they are overcoming these hurdles?

Yes - I do not trust my users to not inject Javascript into their blog-posts. 😄 I would, probably.

---

<div class="post-metadata">

**Author:** ![matthiask](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/matthiask/32/115_2.png) [@matthiask](https://forum.djangoproject.com/u/matthiask)\
**Post date:** [September 13, 2020, 7:41am UTC](https://forum.djangoproject.com/t/ckeditor-turn-off-autoescaping-judiciously-for-javascript/4322/2 "2020-09-13T07:41:36Z")

</div>

That’s an issue with all editors generating HTML. You should post-process the HTML on the serverside to ensure that script tags etc. are removed from the source. There are various solutions for this:

- [https://pypi.org/project/html-sanitizer/](https://pypi.org/project/html-sanitizer/) (that’s my solution, and it’s very opinionated)
- [https://github.com/mozilla/bleach](https://github.com/mozilla/bleach)
- html-sanitizer uses `lxml.html.clean.Cleaner` under the hood; this can also be used directly and works well too [https://lxml.de/api/lxml.html.clean.Cleaner-class.html](https://lxml.de/api/lxml.html.clean.Cleaner-class.html)

There are other solutions of course.

---

<div class="post-metadata">

**Author:** ![anon36149362](https://avatars.discourse-cdn.com/v4/letter/a/bc8723/32.png) [@anon36149362](https://forum.djangoproject.com/u/anon36149362)\
**Post date:** [September 13, 2020, 11:01pm UTC](https://forum.djangoproject.com/t/ckeditor-turn-off-autoescaping-judiciously-for-javascript/4322/3 "2020-09-13T23:01:34Z")

</div>

Thanks, your project looks very promising. I notice you do a CMS, too. Looks very interesting. I’ll be checking it out shortly. I might need to use a Django based CMS soon.