foo@bar.com\ \ It works in the sense that the resulting email is valid but misses the point of obfuscation. > [@kaushalmodi](#): > > Seems to work fine… So do you want to escape each and every letter as in your hardcoded div? What I want is the values preserved as in the “hardcoded” div but without hardcoding them. ---

**Author:** ![butaca](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/butaca/32/5159_2.png) [@butaca](https://discourse.gohugo.io/u/butaca)\ **Post date:** [August 1, 2018, 4:48pm UTC](https://discourse.gohugo.io/t/avoid-string-variable-escaping/13244/10 "2018-08-01T16:48:44Z")

> [@butaca](#): > > It seems like the template is post processing its dynamic content. I read a bit about go html/template package and it escaping the content contextually, trusting the template and not trusting the dynamic content. About href, taken from [template package - html/template - Go Packages](https://golang.org/pkg/html/template/) : > ``` > This package understands HTML, CSS, JavaScript, and URIs. It adds sanitizing functions to each simple action pipeline, so given the excerpt > > {{.}} > At parse time each {{.}} is overwritten to add escaping functions as necessary. In this case it becomes > > {{. | htmlescaper}} > where urlescaper, attrescaper, and htmlescaper are aliases for internal escaping functions. > > ``` I tried to bypass it without success (sorry for my go, I’m new to it): [Go Playground - The Go Programming Language](https://play.golang.org/p/xE0W1fwp9nj) Maybe @bep knows a way to bypass the escaping? ---

**Author:** ![rhcarvalho](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rhcarvalho/32/8482_2.png) [@rhcarvalho](https://discourse.gohugo.io/u/rhcarvalho)\ **Post date:** [April 22, 2019, 4:07pm UTC](https://discourse.gohugo.io/t/avoid-string-variable-escaping/13244/11 "2019-04-22T16:07:14Z")

_Reviving for the sake of documenting a solution._ @butaca you’re absolutely spot on regarding the contextual awareness of `html/template`. That’s one of the features that makes it great! Here’s how you can bypass it for an arbitrary HTML attribute: **Template** ```auto {{ $v := "a" }} {{ $v | safeHTML }} ``` **Output** ```auto a ``` * * * Note that whenever you use the `safe*` functions ( `safeHTML` , `safeHTMLAttr` , etc), it means you fully trust the input. A malicious input could infect your website. Compare what happens when you mark unsafe values as safe: **Template** ```auto {{ $v := "\">" }}

Safe: {{ $v }}

Unsafe use of safe*: {{ $v | safeHTML }}

``` **Output** ```auto

Safe: "><script>alert('hello')</script>

Unsafe use of safe*: ">">

```