---
title: "Keep input out of templates · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/injection/template-injection
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep input out of templates

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Injection](https://agentwranglers.se/playbook/adversarial-testing/injection)
- Rule: Pass user input to a template as data. Never use it as the template itself.
- How: Load templates only from your own files. If customers write their own text, such as email messages, use a small placeholder list like `{name}` and replace only those. Run full template engines only in a sandbox.
- Check: Put `{{7*7}}`, `${7*7}`, `#{7*7}` and `<%= 7*7 %>` in fields that end up in emails, PDFs or pages. The output shows the text as typed, never 49.

Example:

```python
# Bad: the customer's text becomes the template
jinja_env.from_string(customer_text).render(order=order)
# Good: a fixed template, with the customer's text passed in as data
jinja_env.get_template("order-email.html").render(order=order, note=customer_text)
```

```js
// Bad: the customer's text becomes the template
ejs.render(customerText, { order });
// Good: only known placeholders are replaced, everything else stays text
const PLACEHOLDERS = { name: order.customerName, number: order.number };
const message = customerText.replace(/\{(\w+)\}/g, (match, key) => PLACEHOLDERS[key] ?? match);
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/injection/template-injection`.

- Previous: [Never pass input to a shell](https://agentwranglers.se/playbook/adversarial-testing/injection/command-injection)
- Next: [Strip line breaks from headers and logs](https://agentwranglers.se/playbook/adversarial-testing/injection/header-injection)
- [Injection](https://agentwranglers.se/playbook/adversarial-testing/injection)