//nefariousplan

Escape Was For The Other Engine

A server-side safety primitive (autoescape pragma, default-encoded template engine, framework HTML helper) correctly covers one rendering pipeline at one trust boundary. The same file or response emits a second rendering pipeline at a different trust boundary, typically client-side template-literal interpolation into innerHTML, on data that arrives by a separate channel. The primitive does not see the second pipeline because the primitive's interpreter does not run there. The developer reads the pragma as "this file is escaped" and is right about the engine the pragma names.