---
name: "Template::Stash::AutoEscaping"
section: "3pm"
platform: "linux"
package: "libtemplate-stash-autoescaping-perl"
version: "0.0303-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/Template::Stash::AutoEscaping"
---

# Template::Stash::AutoEscaping(3pm)

escape automatically in Template-Toolkit.

## NAME

Template::Stash::AutoEscaping - escape automatically in Template-Toolkit.

## SYNOPSIS

```
  use Template;
  use Template::Stash::AutoEscaping;
  my $tt = Template->new({
    STASH => Template::Stash::AutoEscaping->new
  });
```

## METHODS

### new

- die\_on\_unescaped

  This value, if set to a true value, causes the process to throw an exception upon encountering a value that was not explicitly set to be escaped or was marked as a raw value.

- escape\_type

  default is HTML

- method\_for\_escape

  The default method to escape a value explicitly (mostly useful with `"die_on_unescaped"` .

- method\_for\_raw

  default is raw, you can get not escaped value from \[% value.raw %\]

- escape\_method

  ```
    my $tt = Template->new({
      STASH => Template::Stash::AutoEscaping->new({
          escape_method => sub { my $text = shift; ... ; return $text }
      })
    });
  ```

- ignore\_escape

  ```
    my $stash = Template::Stash::AutoEscaping->new({ignore_escape => [qw(include_html include_raw my_escape_func)], ... );
    You can disable auto-escape for some value or TT-Macro.
    For example: include other component, for output safety html, using other escape method, etc.
  ```

### class\_for

```
    Template::Stash::AutoEscaping->class_for("HTML") # Template::Stash::AutoEscaping::Escaped::HTML
    Template::Stash::AutoEscaping->class_for("HTML" => "MyHTMLString");
```

### escape

**For internal use**.

### escape\_count

**For internal use**.

### get

**For internal use**.

### get\_raw\_args

**For internal use**.

## DESCRIPTION

Template::Stash::AutoEscaping is a sub class of Template::Stash, automatically escape all HTML strings and avoid XSS vulnerability.

## CONFIGURE

- $Template::Stash::AutoEscaping::ESCAPE\_ARGS

  ```
   default is 0. for example "key of hash" or "args of vmethods" are not escaped. I think this is good in most cases.
   [% hash.${key} %] [% hash.item(key) %] means [% hash.${key.raw} | html %] [% hash.item(key.raw) | html %] by default.
  ```

## AUTHOR

mala \<cpan@ma.la\> (original author of Template::Stash::AutoEscape)

Shlomi Fish (\<http://www.shlomifish.org/\>) added some enhancements and fixes, while disclaiming all rights, as part of his work for \<http://reask.com/\> and released the result as `"Template::Stash::AutoEscaping"` .

## SEE ALSO

Template, Template::Stash::EscapedHTML, Template::Stash::AutoEscape

## LICENSE

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.