++ed by:

1 PAUSE user
2 non-PAUSE users.

Author image Matt S Trout
and 1 contributors


HTML::String::TT - HTML string auto-escaping for Template Toolkit


  my $tt = HTML::String::TT->new(\%normal_tt_args);

or, if you're using Catalyst::View::TT:

  use HTML::String::TT; # needs to be loaded before TT to work

    CLASS => 'HTML::String::TT',

Then, in your template -

    [% title %] <-- this will be automatically escaped
  <div id="main">
    [% some_html | no_escape %] <-- this won't
  [% html_var = '<foo>'; html_var %] <-- this won't anyway

(but note that the content key in wrappers shouldn't need this).


HTML::String::TT is a wrapper for Template Toolkit that installs the following overrides:

The override happens to all of the plain strings in your template, so even things declared within directives such as

  [% html_var = '<h1>' %]

will not be escaped, but any string coming from anywhere else will be. This can be a little bit annoying when you then pass it to things that don't respond well to overloaded objects, but is essential to HTML::String's policy of "always fail closed" - I'd rather it throws an exception than lets a value through unescaped, and if you care about your HTML not having XSS (cross site scripting) vulnerabilities then I hope you'll agree.

We mark a number of TT internals namespaces as "don't escape when called by these", since TT has a tendency to do things like

  open FH, "< $name";

which really don't work if it gets converted to &quot; $name while you aren't looking.

Additionally, since TT often calls ref to decide e.g. if something is a string or a glob, it's important that UNIVERSAL::ref is loaded before TT is. We check to see if the latter is loaded and the former not, and warn loudly that you're probably going to get weird errors.

This warning is not joking. "Probably" is optimistic. Load this module first.



The no_escape filter marks the filtered input to not be escaped, so that you can provide HTML chunks from externally and still render them within the TT code.


See HTML::String for authors.


See HTML::String for the copyright and license.