Django automatically assumes all user-contributed content and content in your database is unsafe, when rendering a Django template: http://docs.djangoproject.com/en/dev/ref/templates/builtins/#autoescape

As well, if provides a middleware that protects against CSRF. http://docs.djangoproject.com/en/dev/ref/contrib/csrf/