Lodash _.templateSettings.escape

What You’ll Learn

By the end of this tutorial, you’ll understand Lodash’s escape RegExp, how it differs from safe interpolate tags, and when raw HTML output is appropriate.

What Is _.templateSettings.escape?

_.templateSettings.escape is a RegExp that marks delimiter tags for unescaped value insertion in Lodash templates. Despite the name, it does not assign an escape function—it defines which syntax produces raw HTML output (default: open-percent-minus tags).

Customize the escape RegExp when you need a different raw-output delimiter while keeping interpolate on another syntax (for example Mustache braces for values and ERB-minus for trusted partials).

📝 Syntax

Assign a RegExp to the global settings object (or pass it per compile):

_.templateSettings.escape = /PATTERN/g;

// Default Lodash raw-output pattern:
// /<%-([\s\S]+?)%>/g

Syntax Rules

• Type — must be a RegExp, never a function.
• Default tag — open-percent-minus inserts values without calling _.escape.
• Safe default — open-percent-equals interpolate tags escape HTML via _.escape.
• Capture group — group 1 holds the JavaScript expression whose value is inserted raw.
• Compile time — Lodash reads the pattern when _.template() runs.

import template from "lodash/template";

// Safe: user text through interpolate (escaped)
const safeTpl = template("<p><%= obj.comment %></p>");
console.log(safeTpl({ comment: '<script>alert(1)</script>' }));
// -> "<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>"

Examples Gallery

Practical escape patterns with copy-ready code, sample output, and interactive Try It Yourself labs.

const malicious = '<img src=x onerror=alert(1)>';

const safeTpl = _.template("<div><%= obj.comment %></div>");
console.log(safeTpl({ comment: malicious }));
// HTML entities — script does not run as markup

<div>&lt;img src=x onerror=alert(1)&gt;</div>

const trustedHtml = "<strong>Sale</strong> ends tonight!";

const rawTpl = _.template("<aside><%- obj.banner %></aside>");
console.log(rawTpl({ banner: trustedHtml }));
// -> "<aside><strong>Sale</strong> ends tonight!</aside>"

<aside><strong>Sale</strong> ends tonight!</aside>

const input = "<b>Hi</b>";
const data = { text: input };

const escaped = _.template("E: <%= obj.text %>")(data);
const raw = _.template("R: <%- obj.text %>")(data);

console.log(escaped);
// E: &lt;b&gt;Hi&lt;/b&gt;

console.log(raw);
// R: <b>Hi</b>

E: <b>Hi</b>
R: <b>Hi</b>

const layoutTpl = _.template(
  "<article>" +
  "<h1><%= obj.title %></h1>" +
  "<%- obj.bodyHtml %>" +
  "</article>"
);

console.log(layoutTpl({
  title: 'User & Partners',
  bodyHtml: "<p>Pre-rendered CMS content.</p>"
}));

<article><h1>User &amp; Partners</h1><p>Pre-rendered CMS content.</p></article>

const tpl = _.template(
  "Note: [[ obj.note ]]",
  { escape: /\[\[([\s\S]+?)\]\]/g }
);

console.log(tpl({ note: "<em>Important</em>" }));
// -> "Note: <em>Important</em>"

Note: <em>Important</em>

const userInput = '<script>alert(1)</script>';

const tpl = _.template("<%- obj.safeText %>");
const output = tpl({ safeText: _.escape(userInput) });

console.log(output);
// Entities printed — still prefer <%= obj.text %> instead

<script>alert(1)</script>

📝 Notes

• templateSettings.escape is a RegExp, not an escape function.
• Escape-pattern tags output raw HTML—dangerous with user input.
• Interpolate tags call _.escape automatically—default safe path.
• The property name is historical ERB terminology—read Lodash docs, not the label alone.
• Use _.escape() in JavaScript when pre-processing strings outside templates.
• Never compile templates from untrusted users regardless of tag type.

💡 Best Practices