# HTML `deft/stdext/html` implements the handlers behind the `[html … \html]` and `[codeblock … \codeblock]` templating blocks, plus the escaping helper used with them. The same semantics are covered in the app-server manual — see Templating — this page is the module reference.

import "deft/stdext/html" as html
from "deft/stdext/html" import @{ html html-raw codeblock html-escape }

## API | Def | Signature | Description | |---|---|---| | `html` | `{| block |}` | Block handler for `[html … \html]`. Joins the parsed parts and returns a `%__HtmlSafe` value. | | `html-raw` | `{| value |}` | Marks a value as trusted HTML (no escaping); passes `%__HtmlSafe` through unchanged. | | `html-escape` | `{| text |}` | Entity-escapes `& < > " '` and returns a plain string. | | `codeblock` | `{| arg |}` | Block handler for `[codeblock … \codeblock]` (or a plain string): trims blank edges and returns a syntax-highlighted `%__HtmlSafe`. | ## Escaping Is Explicit `[html …]` does not escape interpolated values. `$var`, `[cmd]` and `$[cmd]` parts are emitted verbatim; wrap untrusted text in `[html-escape …]` and trusted markup in `[html-raw …]`.

set name "World"
set evil "<script>alert(1)</script>"

[html <p>Hello $name</p> \html]              # trusted interpolation
[html <p>[html-escape $evil]</p> \html]      # escaped text
[html <p>[html-raw "<b>bold</b>"]</p> \html] # trusted fragment

A value returned by `html`, `html-raw`, or `codeblock` is a `%__HtmlSafe{:value "…"}` tagged map. Nesting one inside another `[html …]` block passes it through untouched, and the HTTP server serves a returned `%__HtmlSafe` as `text/html` (recursively unwrapping). ## Code Blocks

set rendered [codeblock $source \codeblock]     # highlighted
set verbatim [*codeblock  set x 1  \codeblock]  # raw capture, no interpolation

`codeblock` strips leading/trailing blank lines and calls the native `deft/syntax-highlight` function to produce `<span class="…">` markup. Use `[*codeblock … \codeblock]` when the interior must be captured verbatim (source listings containing `[`, `$`, or `{`). ## See Also - Templating — the full block syntax and escaping contract - SQL — the same block-handler pattern for SQL - Syntax — the highlighters driving TUI code rendering