[1.7.X] Fixed #23561 -- Corrected a security doc example that requires an unquoted HTML attribute.

Thanks "djbug" for the report.

1 files changed, 2 insertions, 2 deletions

diff --git a/docs/topics/security.txt b/docs/topics/security.txt
index 23c341ae8a..c3167a4fe2 100644
--- a/docs/topics/security.txt
+++ b/docs/topics/security.txt
@@ -31,11 +31,11 @@ protect the following:
 
 .. code-block:: html+django
 
-    <style class="{{ var }}">...</style>
+    <style class={{ var }}>...</style>
 
 If ``var`` is set to ``'class1 onmouseover=javascript:func()'``, this can result
 in unauthorized JavaScript execution, depending on how the browser renders
-imperfect HTML.
+imperfect HTML. (Quoting the attribute value would fix this case.)
 
 It is also important to be particularly careful when using ``is_safe`` with
 custom template tags, the :tfilter:`safe` template tag, :mod:`mark_safe