Lodash _.templateSettings.escape

Beginner
5 min read
Updated: Nov 2026
5 examples
Template
Decorative image with the word ESCAPE

Definition

A RegExp that marks tags whose values are HTML-escaped by _.template() (default <%- ... %>). Part of Lodash Properties (stable in 4.x — not deprecated). Warning: never compile untrusted template strings — _.template builds executable code; Lodash plans to remove it in v5.

Set the property globally, or override it per call with options passed to _.template().

Syntax

Use _.templateSettings.escape. Start with this line.

Lodash
_.templateSettings.escape
CallWhat it does
_.templateSettings.escapePrimary setting.
_.templateSettings.escape = /.../gAssign a custom RegExp or value before compiling.

Prefer the full Lodash build when using _.template() and _.templateSettings.

Library declarations
Lodash
_.templateSettings.escape

Parameters

ParameterDescription
_.templateSettings.escapeOptional. (RegExp) Pattern for HTML-escape tags
Default patternOptional. (RegExp) /<%-([\s\S]+?)%>/g
Capture groupRequired. Expression inside the tag

Return Value

Return ValueDescription
*RegExp (with a capturing group)

Lodash Examples

Example 1 — Official: HTML Escape Delimiter

Escape tags convert markup characters to HTML entities.

Lodash
var compiled = _.template('<b><%- value %></b>');
compiled({ 'value': '<script>' });
// → '<b>&lt;script&gt;</b>'
Try It Yourself

How It Works

  1. Tag. <%- value %> matches templateSettings.escape.
  2. Read. The expression resolves to "<script>".
  3. Escape. _.escape encodes < and >.
  4. Result. Safe text inside the <b> wrapper.

Example 2 — Escape vs Interpolate

Same data; only the delimiter changes the safety of the output.

Lodash
var data = { value: '<i>x</i>' };

_.template('E:<%- value %>')(data);
// → 'E:&lt;i&gt;x&lt;/i&gt;'

_.template('I:<%= value %>')(data);
// → 'I:<i>x</i>'   (raw HTML inserted)
Try It Yourself

How It Works

  1. Escape. Tags use _.escape → entities in the string.
  2. Interpolate. Tags insert the raw string as HTML markup.
  3. Choose. Prefer escape tags for untrusted text in HTML.
  4. Name tip. “escape” means “HTML-escape,” not “skip escaping.”

Example 3 — Ampersands and Quotes

_.escape also encodes &, ", and '.

Lodash
var compiled = _.template('Hi <%- name %>');
compiled({ name: 'Tom & Jerry' });
// → 'Hi Tom &amp; Jerry'
Try It Yourself

How It Works

  1. Input. Name contains &.
  2. Escape tag. Runs the value through _.escape.
  3. Entity. & becomes &amp; in the output string.
  4. Display. The browser shows a single ampersand to the user.

Example 4 — Custom Escape Delimiters

Override the RegExp per compile (or on templateSettings.escape).

Lodash
var compiled = _.template(
  'Hello {{- name -}}!',
  { escape: /{{-([\s\S]+?)-}}/g }
);
compiled({ name: '<Ada>' });
// → 'Hello &lt;Ada&gt;!'
Try It Yourself

How It Works

  1. Option. Per-call escape overrides the global setting.
  2. Pattern. Must include one capturing group for the expression.
  3. Still escapes. Matched tags still run through _.escape.
  4. Safer scope. Prefer options over mutating templateSettings globally.

Example 5 — User Text in HTML

Use escape tags when echoing untrusted names into markup.

Lodash
var tpl = _.template(
  '<p class="msg">Welcome, <%- user %>!</p>'
);
tpl({ user: 'Sam<img onerror=alert(1)>' });
// → '<p class="msg">Welcome, Sam&lt;img onerror=alert(1)&gt;!</p>'
Try It Yourself

How It Works

  1. Threat. A crafted name tries to inject an HTML tag.
  2. Escape tag. Encodes < / > before insert.
  3. Result. Markup is inert text, not a live element.
  4. Note. This does not make untrusted template source safe — only data inside escape tags.
Compatibility

Browser & Runtime Support

_.templateSettings.escape ships with Lodash full builds (stable in 4.x). It configures _.template, which runs anywhere Lodash runs — modern browsers (CDN or bundle) and Node.js / Bun / Deno with npm install lodash.

✓ Stable · Lodash 4.x · Warning: template security

_.templateSettings.escape

Available on the [email protected] namespace. Works in evergreen browsers and current Node LTS when Lodash is installed. Treat _.template as legacy for untrusted template source.

100% With Lodash 4.x
Google Chrome Supported · Desktop & Mobile
Full support
Mozilla Firefox Supported · Desktop & Mobile
Full support
Apple Safari Supported · macOS & iOS
Full support
Microsoft Edge Supported · Chromium
Full support
Internet Explorer No native support · Use a polyfill
Polyfill
Opera Supported · Modern versions
Full support
Samsung Internet Supported · Android
Full support
Bun Supported · JavaScript runtime
Supported
Deno Supported · JavaScript runtime
Supported
Node.js Supported · Server runtime
Supported
Android WebView Supported · Modern WebView
Full support
.escape Lodash 4.x

Bottom line: Use escape tags for HTML-safe data insertion. Prefer per-call { escape } options over global mutation. Never compile untrusted template strings.

Frequently Asked Questions

It is a RegExp that tells _.template() which tags should HTML-escape values before insert. The default matches <\x25- ... \x25> tags.
A RegExp. Lodash uses it at compile time to find escape tags. Do not assign a callback to templateSettings.escape.
Escape tags (<\x25- \x25>) run _.escape on the value. Interpolate tags (<\x25= \x25>) insert the value as-is (not HTML-escaped).
When rendering text into HTML and you want &, <, >, ", and ' converted to entities — especially for user-provided strings.
Yes. Pass { escape: /.../g } to _.template(string, options) to override _.templateSettings.escape for that compile only.
No. Compiling untrusted templates can execute code. Use only developer-controlled templates. Lodash plans to remove _.template in v5.

Next: _.templateSettings.evaluate

Configure the RegExp for JavaScript evaluation tags.

.evaluate tutorial →

About the author

Mari Selvan M P
Mari Selvan M P 🔗

Developer, cloud engineer, and technical writer

  • Experience 12 years building web and cloud systems
  • Focus Full Stack Development, AWS, and Developer Education

I write practical tutorials so students and working developers can learn by doing—from databases and APIs to deployment on AWS.

AWS Certified Developer – Associate (Credly)

10 people found this page helpful

Lodash _.templateSettings Lodash _.templateSettings.evaluate