# template
> Package template.
HTML templates that escape each value for where it lands, and plain-text
templates for email bodies and other text. The syntax is Go's
(`{{ .field }}`, `if`, `range`, `with`, `define`, pipelines), and so is the
safety model: escaping is decided by the HTML around each action when the
template is parsed, not by the caller remembering to escape.
```slang
import "template";
gc struct Item { name: str, url: str, price: int }
gc struct Page { title: str, items: [Item], user: str }
let r = template.parse("page",
"{{ .title }}
" +
"" +
"");
guard let t = r else let e = err_of(r) { panic(e); } // syntax and context errors, with line numbers
let html = template.render(t, page); // result[str, str]
template.add(t, "layout", "{{ template \"page\" . }}");
template.render_named(t, "layout", page);
let mail = template.parse_text("welcome", "Hi {{ .name }},\n{{ range .items }}- {{ .name }}\n{{ end }}");
```
Each action is escaped for its context:
| Where | What the value becomes |
|---|---|
| text, quoted attribute | `& < > " '` as character references |
| URL attribute (`href`, `src`, `action`, …), at the start | only `http`, `https`, `mailto`, `tel` or a relative URL; anything else, `javascript:` above all, becomes `about:invalid#blocked` |
| later in a URL | percent-encoded (`/search?q={{ .q }}`) |
| `