Rendering Templates

Flask renders templates using render_template().

diagram from a view return to bytes on the wire mermaid

  flowchart TD
  A["view returns render_template('page.html', user=u)"] --> B["Jinja loads templates/page.html"]
  B --> C{"does the name end in .html/.htm/.xml/.xhtml/.svg?"}
  C -->|yes| D["autoescape ON"]
  C -->|no| E["autoescape OFF"]
  D --> F["{{ user.name }} is HTML-escaped"]
  E --> G["{{ user.name }} is inserted raw"]
  F --> H["string returned to Flask"]
  G --> H
  H --> I["wrapped in a Response, 200, text/html"]

render_template does not return HTML to your browser; it returns a string to Flask, which wraps it in a response. The step worth knowing is autoescaping, which is decided by the template's FILE NAME before any of your data is inserted.

Flask decides autoescaping from the template’s name. In Flask 3.1.3 the implementation (flask/sansio/app.py) is exactly this:

python

return filename.endswith((".html", ".htm", ".xml", ".xhtml", ".svg"))

Measured results:

Template name	Autoescape
`page.html`, `page.htm`, `page.xml`, `page.xhtml`, `page.svg`	on
`page.txt`, `page.md`	off
`page.j2`, `page.jinja`	off
`page.html.j2`, `page.html.jinja`	off

The last row is the dangerous one. page.html.j2 is a popular naming convention — and because the check is endswith, the .j2 is what counts, so autoescaping is off and every {{ }} inserts raw HTML.

If you prefer that naming, set it explicitly:

python

app.jinja_env.autoescape = True

or override select_jinja_autoescape. A .txt template being unescaped is correct — a plain text email should not have & in it — but an HTML template that is unescaped by accident is an XSS hole.

Step 1: create a template file

Create templates/home.html:

html

<!doctype html>
<html>
  <head>
    <title>Home</title>
  </head>
  <body>
    <h1>Welcome to Flask</h1>
  </body>
</html>

Step 2: render it from a route

python

from flask import Flask, render_template
 
app = Flask(__name__)
 
 
@app.route("/")
def home():
    return render_template("home.html")

Flask will:

find templates/home.html
render it (no variables yet)
return the HTML as an HTTP response

How template lookup works

Flask searches the templates folder relative to your app.

If you see:

TemplateNotFound: home.html

It usually means:

your templates folder is missing or incorrectly placed
your working directory is wrong
you’re using a package layout and need to confirm the path

🧪 Try It Yourself

Exercise 1 – Create a Flask App

Exercise 2 – Dynamic Route

Exercise 3 – Return JSON

pch.coffeeTagline

pch.coffeeCta

pch.feedbackHeading

pch.feedbackSubheading