title: Is autoescape off in django safe?
body: <p>I want to display some HTML in <code>Django 1.0</code> templates and to do that I have been doing something like this:</p>
  
  <pre><code>{% autoescape off %}{{ var.text }}{% endautoescape %}
  
  </code></pre>
  
  <p>and I am just wondering how safe this is?  Am I still protected against SQL injection and cross-site scripting and other vulnerabilities like that?</p>
  
  <p><strong>Update:</strong></p>
  
  <p>This text will be coming from users, so what is the best way to display HTML in a Django template safely?</p>