Fixed #4991 -- Emphasized XSS ramifications of help_text not being escaped. (5dbe2a94) · Commits · Dom Sekotill / django

docs/ref/models/fields.txt

+3 −1

Original line number	Diff line number	Diff line
		@@ -260,7 +260,9 @@ desire. For example::
		help_text="Please use the following format: <em>YYYY-MM-DD</em>."

		Alternatively you can use plain text and
		``django.utils.html.escape()`` to escape any HTML special characters.
		``django.utils.html.escape()`` to escape any HTML special characters. Ensure
		that you escape any help text that may come from untrusted users to avoid a
		cross-site scripting attack.

		``primary_key``
		---------------