diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/ref/models/fields.txt | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/docs/ref/models/fields.txt b/docs/ref/models/fields.txt index d66ee37c47..0466534e07 100644 --- a/docs/ref/models/fields.txt +++ b/docs/ref/models/fields.txt @@ -260,7 +260,9 @@ desire. For example:: help_text="Please use the following format: <em>YYYY-MM-DD</em>." Alternatively you can use plain text and -``django.utils.html.escape()`` to escape any HTML special characters. +``django.utils.html.escape()`` to escape any HTML special characters. Ensure +that you escape any help text that may come from untrusted users to avoid a +cross-site scripting attack. ``primary_key`` --------------- |