What I really don't get is how it's any different than applying whatever function you would apply to the template, on the f-string variables. So instead of:
evil = "<script>alert('bad')</script>"
template = t"{evil}"
safe = html(template)
Why not just: evil = "<script>alert('bad')</script>"
safe = f"{html(evil)}"
Or even before creating the f-string. Is it just about not forgetting the sanitization/string manipulation part and forcing you to go through that? replies(2):