Server-Side Templates

DIRS lists project template directories searched first, in order; APP_DIRS=True adds each installed app's templates/ subdirectory, searched in INSTALLED_APPS order. Django uses the first file that matches and raises TemplateDoesNotExist if none does.

A filter follows a pipe inside {{ }} and transforms the value before output. Filters chain left to right, each receiving the previous result, and each takes at most one argument after a colon: a literal, a number or a variable.

A child template starts with {% extends 'base.html' %}; each {% block %} it defines replaces the same-named block in the parent, blocks it skips keep the parent's default, and {{ block.super }} inserts the parent block's content instead of discarding it.

{% for item in items %} repeats its body per element; an {% empty %} clause renders instead when the sequence is empty or missing. Inside, forloop exposes counter, counter0, revcounter, revcounter0, first, last, length and parentloop.

Each dot tries a dictionary key, then an attribute or method, then a list index, and keeps the first that works; if the value found is callable, Django calls it with no arguments and uses the result.

Write a function that takes the request and returns a dict such as {'store': ...}, add its dotted path to OPTIONS['context_processors'], and it runs on every render that has a request — render(), render_to_string(..., request=request), generic views — but never on a request-less render.

Put a module in the app's templatetags package, create register = template.Library(), decorate a function with @register.filter, and use {% load module_name %} in the template. The app must be in INSTALLED_APPS, and the dev server needs a restart.

Write a tag when you need several arguments, the context, a new variable or a rendered fragment; a filter only transforms one value with one argument. simple_tag returns a value; inclusion_tag returns a dict that renders its own template.

A failed lookup is swallowed on purpose: Django renders the engine's string_if_invalid option, an empty string by default. To catch typos, temporarily set string_if_invalid to a visible marker, read the django.template DEBUG log, or assert rendered output in tests.

The default filter replaces any falsy value, so a legitimate 0, Decimal("0.00"), empty string or empty list shows the fallback. default_if_none replaces only None, so a real zero discount still renders as 0.00.

{% url 'name' args %} outputs the path of a named URL pattern and raises NoReverseMatch if reversing fails, unless written with as var. {% csrf_token %} outputs a hidden csrfmiddlewaretoken input, or nothing when the context lacks a token.

Use {{ data|json_script:'review-data' }}, which serializes to JSON, escapes <, > and & and wraps it in a non-executing application/json script tag that JavaScript reads with JSON.parse; escapejs only makes a value safe inside a quoted JavaScript string literal.

mark_safe() only labels a string as safe without escaping anything, so user data interpolated by an f-string reaches the page raw; format_html() escapes each argument with conditional_escape and then marks the combined result safe.

Rendering a child renders its parent; the child contributes only its {% block %} overrides, so text, tags and variables placed outside any block in the child are never output.

A plain {% include %} renders the other template with the full current context; with key=value adds variables for that include only; only restricts it to the with values, dropping view and context-processor variables such as user and request.

{% if %} supports and, or, not, comparisons, in, not in, is and is not, with filtered operands. Parentheses are invalid and and binds tighter than or, so nest tags for other grouping. {% with %} names an expensive lookup once.

Django calls any callable it meets with no arguments. alters_data = True blocks the call and renders string_if_invalid, protecting methods like save() and delete(); do_not_call_in_templates = True leaves the object uncalled so its attributes stay reachable.

The |safe filter marks the reviewer's text as trusted HTML, so any script or event-handler markup they typed runs for every visitor; remove it and use |linebreaks, which escapes the text before adding <p> and <br>, or sanitize real rich text first.

With DjangoTemplates and no OPTIONS['loaders'], Django wraps its filesystem and app-directories loaders in cached.Loader in every environment; setting loaders yourself replaces that default, forbids APP_DIRS, and caches only if you wrap the list in the cached loader.

is_safe=True keeps a safe input's result marked safe, for filters that add no HTML characters. needs_autoescape=True passes the current autoescape mode so a filter that builds HTML can escape its inputs. expects_localtime=True converts aware datetimes to the current time zone first.

An inclusion tag renders its template with a fresh context holding only the dictionary its function returns, plus csrf_token. Use takes_context=True, name the first parameter context, and return the values the fragment needs.

Dictionary lookup runs before attribute lookup, so scores.items becomes scores["items"]; a defaultdict creates that key and returns an empty list, so the loop iterates nothing. Convert to a plain dict, or pass pre-built pairs, in the view.

The Jinja2 backend loads templates from each app's jinja2/ folder, knows none of Django's tags or filters, adds only request, csrf_input and csrf_token globals, and is customised through an environment callable; the admin still requires a DjangoTemplates engine.

{% querystring %} rebuilds the query string from request.GET with changes: keyword arguments add or replace keys and None removes one, so page links keep active filters. Since Django 6.0 the output always starts with ?.

Wrap the row in {% partialdef booking-row inline %} in the list template, loop over it with {% partial booking-row %} or inline, and have the update view call render(request, 'bookings/list.html#booking-row', {'booking': booking}) to return only that fragment.

An exception raised by code a lookup runs, such as a property or method, propagates unless its class sets silent_variable_failure = True. ObjectDoesNotExist sets it, so a missing related object renders string_if_invalid; an ordinary AttributeError or ZeroDivisionError inside a property or method stops the render.