# Escaping Meta Tag Content? Help

**URL:** <https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370>\
**Category:** support\
**Created:** [September 24, 2018, 3:00am UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370 "2018-09-24T03:00:50Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![rdegges](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdegges/32/678_2.png) [@rdegges](https://discourse.gohugo.io/u/rdegges)\
**Post date:** [September 24, 2018, 3:00am UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/1 "2018-09-24T03:00:50Z")

</div>

Hi there.

I’m currently running into a frustrating issue that I can’t seem to figure out =/ I’ve got a template that looks like this:

`<meta name="description" content="{{ .Page.Description }}">`

Simple enough – it outputs a meta tag. Then in one of my posts (this is a blog), I’ve defined my frontmatter to look like the following:

```
---
layout: blog_post
title: 'blah blah'
date: 2018-09-21T00:00:00Z
description: "This is a cool post. It's pretty awesome."
--- 

```

I am snipping some supporting stuff out of the templates above for simplicity, but the issue is the apostrophe in the page’s description.

When I view the source code of the page, the meta tag appears like this:

`<meta name="description" content="This is a cool post. It&amp;#39;s pretty awesome.">`

I’ve tried using `{{ .Page.Description | safeHTML }}`, `{{ .Page.Description | htmlEscape }}`, and `{{ .Page.Description | htmlUnescape }}` – none fix the problem for me.

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![FelicianoTech](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/felicianotech/32/22886_2.png) [@FelicianoTech](https://discourse.gohugo.io/u/FelicianoTech)\
**Post date:** [September 24, 2018, 3:18am UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/2 "2018-09-24T03:18:33Z")

</div>

Instead of `safeHTML` have you tried using `safeHTMLAttr`?

In theory that should work since what you’re setting is the value of the content attribute.

---

<div class="post-metadata">

**Author:** ![rdegges](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdegges/32/678_2.png) [@rdegges](https://discourse.gohugo.io/u/rdegges)\
**Post date:** [September 24, 2018, 3:56am UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/3 "2018-09-24T03:56:58Z")

</div>

That doesn’t seem to work.

If I modify my template to look like this:

`<meta property="og:description" content="{{ printf "%s" .Page.Description | safeHTMLAttr }}" />`

Then I get the same output. If I use %q instead of %s, it gets worse, e.g. `<meta property="og:description" content="&amp;#34;This is a cool post. It&amp;#39;s pretty awesome.&amp;#34;" />`

I’m trying everything but running out of ideas.

---

<div class="post-metadata">

**Author:** ![benmarte](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/benmarte/32/5948_2.png) [@benmarte](https://discourse.gohugo.io/u/benmarte)\
**Post date:** [September 24, 2018, 12:14pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/4 "2018-09-24T12:14:46Z")

</div>

That’s pretty weird this is what I use for my description meta tags try doing this and letting it use your page content as your description to see if it still does the weird apostrophe thing.

```auto
<meta name="description" content="{{if isset .Params "description"}} {{.Params.description}} {{else}} {{.Page.Content | safeHTML | truncate 300}} {{end}}">

```

---

<div class="post-metadata">

**Author:** ![rdegges](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdegges/32/678_2.png) [@rdegges](https://discourse.gohugo.io/u/rdegges)\
**Post date:** [September 24, 2018, 12:44pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/5 "2018-09-24T12:44:01Z")

</div>

Hmm, I just tried it that way (using .Params.description like you are instead of .Page.Description), but I have the same bad behavior. Hrmm…

What version of Hugo are you using? I’m on `Hugo Static Site Generator v0.40.1 linux/amd64 BuildDate: 2018-04-25T17:16:11Z`

---

<div class="post-metadata">

**Author:** ![benmarte](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/benmarte/32/5948_2.png) [@benmarte](https://discourse.gohugo.io/u/benmarte)\
**Post date:** [September 24, 2018, 12:48pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/6 "2018-09-24T12:48:17Z")

</div>

I’m using hugo 0.48, that might be the problem you have an older version of hugo.

---

<div class="post-metadata">

**Author:** ![rdwatters](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdwatters/32/2848_2.png) [@rdwatters](https://discourse.gohugo.io/u/rdwatters)\
**Post date:** [September 24, 2018, 2:41pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/7 "2018-09-24T14:41:12Z")

</div>

Huh. Thanks for bringing this up @rdegges. Just started a new Hugo project yesterday and now realize that I’m having the same issue in `<meta>` tags. I’m using `v0.49-DEV/extended` on OSX, and both `safeHTML` and `safeHTMLAttr` don’t seem to help when I build the site.

---

<div class="post-metadata">

**Author:** ![rdwatters](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdwatters/32/2848_2.png) [@rdwatters](https://discourse.gohugo.io/u/rdwatters)\
**Post date:** [September 24, 2018, 2:46pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/8 "2018-09-24T14:46:40Z")

</div>

I’m sure you’ve already checked this, but I think I never noticed because I’m always looking at the meta tags inside Chrome’s dev tools, which automatically converts `#39;` to an apostrophe when I’m doing local dev, so I didn’t notice. However, on build, I’m definitely seeing the same issue…

---

<div class="post-metadata">

**Author:** ![rdegges](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdegges/32/678_2.png) [@rdegges](https://discourse.gohugo.io/u/rdegges)\
**Post date:** [September 24, 2018, 3:07pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/9 "2018-09-24T15:07:32Z")

</div>

Glad I’m not the only one! I just upgraded to 0.49 on linux (64 bit), and I’m still seeing the exact same behavior. I’ve tried just about everything but literally cannot find a way to get it to render without escaping the apostrophes.

I’m at a total loss here. Really confusing.

Anyone else have an idea?

---

<div class="post-metadata">

**Author:** ![benmarte](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/benmarte/32/5948_2.png) [@benmarte](https://discourse.gohugo.io/u/benmarte)\
**Post date:** [September 24, 2018, 3:12pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/10 "2018-09-24T15:12:06Z")

</div>

Can you post your config.toml? I have this on mine:

```auto
pluralizelisttitles = false

[blackfriday]
   extensions = ["hardLineBreak"]
   nofollowLinks = true
   noreferrerLinks = true
   hrefTargetBlank = true

```

Although I don’t think any of this matters just spitballing ideas here.

---

<div class="post-metadata">

**Author:** ![rdegges](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdegges/32/678_2.png) [@rdegges](https://discourse.gohugo.io/u/rdegges)\
**Post date:** [September 24, 2018, 3:14pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/11 "2018-09-24T15:14:17Z")

</div>

Sure, here is my config:

```
name = "blah"
email = "blah@test.com"
baseURL = "https://blah.test.com"
googleAnalytics = "UA-15777010-4"
languageCode = "en-us"
title = "My Site"
theme = "mytheme"
pygmentsCodeFences = true
pygmentsUseClasses = true
pygmentsCodefencesGuessSyntax = true

disqusshortname = "myblog"
paginate = 10
paginatePath = "page"

[permalinks]
  blog = "/blog/:year/:month/:day/:filename/"

[outputFormats]
[outputFormats.RSS]
mediatype = "application/rss"
baseName = "feed"
```

---

<div class="post-metadata">

**Author:** ![FelicianoTech](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/felicianotech/32/22886_2.png) [@FelicianoTech](https://discourse.gohugo.io/u/FelicianoTech)\
**Post date:** [September 24, 2018, 4:24pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/12 "2018-09-24T16:24:02Z")

</div>

This issue looks similar to this: [https://github.com/gohugoio/hugo/issues/5236](https://github.com/gohugoio/hugo/issues/5236)

That could be “solved” by 1) Switching to `safeHTMLAttr` which is the right filter to use but also another PR to Go like the one I did here: [https://github.com/golang/go/pull/27805](https://github.com/golang/go/pull/27805)

The problem for this one is that quotes can have an extra meaning since some people use single quotes for attribute values.

* * *

To summarize the above, the Go templating system is removing it because it’s suppose to. A new PR would be difficult (for me at least) because right now Go has a blacklist of characters allowed within quoted attributes. It makes no distinction between single and double quotes.

Meaning if I made a PR to allow a single quote, the way I did for the “+” character. it would also be allowed in a situation like this:

```auto
<meta name="description" content='{{ .Page.Description }}'>
``

In which case the single quote from your page's description would break the HTML.
```

---

<div class="post-metadata">

**Author:** ![rdegges](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdegges/32/678_2.png) [@rdegges](https://discourse.gohugo.io/u/rdegges)\
**Post date:** [September 24, 2018, 7:26pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/13 "2018-09-24T19:26:06Z")

</div>

Hmm, I just read through your PR and the thread of convos on GitHub. It’s an interesting problem. It seems like sort of an edge case.

The blog I’m building is for my company which has quite a few readers (we’re migrating from jekyll). Unfortunately, I don’t know if Google bot (or any of the other search engine bots, for that matter), will properly render the page title/description for search results if an apostrophe is escaped like that.

Also, you mentioned that you can “solve” this problem by using `safeHTMLAttr` – can you show me how you do that? I tried `safeHTMLAttr` by doing: `{{ printf "%q" .Page.Description | safeHTMLAttr }}` but that didn’t change the results for me. Maybe I’m using it wrong? I also tried %s, for what it’s worth.

---

<div class="post-metadata">

**Author:** ![FelicianoTech](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/felicianotech/32/22886_2.png) [@FelicianoTech](https://discourse.gohugo.io/u/FelicianoTech)\
**Post date:** [September 24, 2018, 8:32pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/14 "2018-09-24T20:32:34Z")

</div>

> [@rdegges](#):
>
> Also, you mentioned that you can “solve” this problem by using `safeHTMLAttr`

Only with the upstream changes to Go. 😕

Do you use Google Search Console? If you do, you can see what information they’ll pulling so maybe you can see if their indexing things right that way? I’m not, this is something that needs to be solved.

---

<div class="post-metadata">

**Author:** ![rdegges](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/rdegges/32/678_2.png) [@rdegges](https://discourse.gohugo.io/u/rdegges)\
**Post date:** [September 24, 2018, 9:23pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/15 "2018-09-24T21:23:50Z")

</div>

Ah, that’s a great suggestion! I’ll give the Google search console a test and report back tomorrow! =D Glad to find out I’m not crazy though.

---

<div class="post-metadata">

**Author:** ![benmarte](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/benmarte/32/5948_2.png) [@benmarte](https://discourse.gohugo.io/u/benmarte)\
**Post date:** [September 24, 2018, 9:27pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/16 "2018-09-24T21:27:51Z")

</div>

Does it still do it if it reads text from the content instead of the description? Maybe my server has an older version of go or something because I can’t reproduce this issue 😕

---

<div class="post-metadata">

**Author:** ![FelicianoTech](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/felicianotech/32/22886_2.png) [@FelicianoTech](https://discourse.gohugo.io/u/FelicianoTech)\
**Post date:** [September 25, 2018, 1:54am UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/17 "2018-09-25T01:54:18Z")

</div>

It happens for me when text is read from .Params or something similar. I’ve tried with both Hugo v0.47 and v0.49, on Ubuntu 18.04.

---

<div class="post-metadata">

**Author:** ![butaca](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/butaca/32/5159_2.png) [@butaca](https://discourse.gohugo.io/u/butaca)\
**Post date:** [September 26, 2018, 4:12pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/18 "2018-09-26T16:12:47Z")

</div>

I’ve seen this issue before and it’s related to the go `html/template` package:

> [@\[NOT A REAL PROBLEM\] How to avoid HTML ascii code in SEO \<meta\> tags?](https://discourse.gohugo.io/t/not-a-real-problem-how-to-avoid-html-ascii-code-in-seo-meta-tags/14119/6):
>
> If you really want to know the technical stuff behind this, you could find this read interesting: [https://golang.org/pkg/html/template/](https://golang.org/pkg/html/template/) Basically the template system that Hugo uses is context aware and doesn’t trust stuff that is parametrized. That’s why the safe functions exist, to tell the template explicitly “you can trust this”. However, I found that in some contexts even the result of the safe functions is filtered. I don’t think there’s a way to bypass this. However if you hardcode the at…

What I found is that If you minify your site with `hugo --minify` the attributes are unescaped.

---

<div class="post-metadata">

**Author:** ![benmarte](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/benmarte/32/5948_2.png) [@benmarte](https://discourse.gohugo.io/u/benmarte)\
**Post date:** [September 26, 2018, 9:39pm UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/19 "2018-09-26T21:39:08Z")

</div>

Interesting might be why I can’t reproduce, gonna have to try minifying to see if I can reproduce.

---

<div class="post-metadata">

**Author:** ![RobSimpson](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/robsimpson/32/5951_2.png) [@RobSimpson](https://discourse.gohugo.io/u/RobSimpson)\
**Post date:** [September 28, 2018, 8:04am UTC](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370/20 "2018-09-28T08:04:11Z")

</div>

Hi guys!

I have the same issue rendering through a shortcode, i.e.

`{{< form-contact action="http://formspree.io/youremail+site@example.com" >}}`

escapes the ‘+’ character. I tried all the safe options already.

Running hugo 0.49 on Ubuntu 18.04.

[Next page](https://discourse.gohugo.io/t/escaping-meta-tag-content-help/14370.md?page=2)