Django：将模型字段标记为模板安全的最佳实践

Question

Right now I have to do something like (template code):

object.name|safe

There's many times where I just simply forget to add the safe filter. My questions:

1. These objects are user submitted and cleaned at the form level. Is there a reason why I should be more careful about marking them safe?

2. If the answer for above is "you're good to go", how do I make the model field safe by default? Without having to remember to use the safe tag?

Answer 1

In regards to #2, there is a poorly documented function called mark_safe that you can use. For example, in a custom form field I've written I need to return a string with HTML code for the label_from_instance method, so I return using mark_safe:

return mark_safe( '<span class="foo">Some HTML output</span>' )

Answer 2

safe is a templatetag dealing with HTML encoding, not with object validation.
See the documentation

You only have to use it if you're outputting TextField with HTML data inside, for example a text field that hyour users are filling with tinyMCE or CKEditor