Verbatim HTML
Verbatim HTML and escaped values
An HTML source page that keeps authored markup and HTML-escapes ordinary Liquid output.
HTML source
Verbatim does not mean unescaped data
This authored HTML passes through the verbatim profile for Syncpress Documentation. Its elements remain markup because they are authored literal text.
Liquid values are different. This value is rendered as text, not as a new element:
<strong>not markup</strong> & "quotes"
The page layout can trust its completed page.content, but authors cannot turn an arbitrary data value into trusted markup with a filter.
HTML escaping is not contextual sanitization. Do not place unvalidated data in URI, CSS, or JavaScript contexts.