Embedded JavaScript templates
npm install ejsEmbedded JavaScript templates

=============================
Security professionals, before reporting any security issues, please reference the
SECURITY.md
in this project, in particular, the following: "EJS is effectively a JavaScript runtime.
Its entire job is to execute JavaScript. If you run the EJS render method without
checking the inputs yourself, you are responsible for the results."
In short, DO NOT submit 'vulnerabilities' that include this snippet of code:
``javascript`
app.get('/', (req, res) => {
res.render('index', req.query);
});
`bash`
$ npm install ejs
Supports both CommonJS and ES Modules.
`javascript`
import ejs from 'ejs';
// Or
const ejs = require('ejs');
Server: CommonJS approach (require) supports Node versions at leastimport
back to v0.12, likely older versions too. ES Modules approach ()
requires a Node version that supports ESM.
CLI: Requires Node v8 or newer.
Browser: EJS supports all modern browsers, but is very likely to work even
in very, very old browsers. Your mileage may vary.
* Control flow with <% %><%= %>
* Escaped output with (escape function configurable)<%- %>
* Unescaped raw output with -%>
* Newline-trim mode ('newline slurping') with ending tag<%_ _%>
* Whitespace-trim mode (slurp all whitespace) for control flow with [? ?]
* Custom delimiters (e.g. instead of <% %>)
* Includes
* Client-side support
* Static caching of intermediate JavaScript
* Static caching of templates
* Complies with the Express view system
`ejs`
<% if (user) { %>
<%= user.name %>
<% } %>
Try EJS online at: https://ionicabizau.github.io/ejs-playground/.
`javascript
const template = ejs.compile(str, options);
template(data);
// => Rendered HTML string
ejs.render(str, data, options);
// => Rendered HTML string
ejs.renderFile(filename, data, options, function(err, str){
// str => Rendered HTML string
});
`
It is also possible to use ejs.render(dataAndOptions); where you pass
everything in a single object. In that case, you'll end up with local variables
for all the passed options. However, be aware that your code could break if we
add an option with the same name as one of your data object's properties.
Therefore, we do not recommend using this shortcut.
- cache Compiled functions are cached, requires filenamefilename
- The name of the file being rendered. Not required if yourenderFile()
are using . Used by cache to key caches, and for includes.root
- Set template root(s) for includes with an absolute path (e.g, /file.ejs).views
Can be array to try to resolve include from multiple directories.
- An array of paths to use when resolving includes with relative paths.context
- Function execution contextcompileDebug
- When false no debug instrumentation is compiledclient
- When true, compiles a function that can be rendereddelimiter
in the browser without needing to load the EJS Runtime
(ejs.min.js).
- Character to use for inner delimiter, by default '%'openDelimiter
- Character to use for opening delimiter, by default '<'closeDelimiter
- Character to use for closing delimiter, by default '>'debug
- Outputs generated function bodystrict
- When set to true, generated function is in strict mode_with
- Whether or not to use with() {} constructs. If falselocals
then the locals will be stored in the object. Set to false in strict mode.destructuredLocals
- An array of local variables that are always destructured fromlocalsName
the locals object, available even in strict mode.
- Name to use for the object storing local variables when not usingwith
Defaults to localsrmWhitespace
- Remove all safe-to-remove whitespace, including leading-%>
and trailing whitespace. It also enables a safer version of lineescape
slurping for all scriptlet tags (it does not strip new lines of tags in
the middle of a line).
- The escaping function used with <%= construct. It is.toString()
used in rendering and is ed in the generation of client functions.outputFunctionName
(By default escapes XML).
- Set to a string (e.g., 'echo' or 'print') for a function to printasync
output inside scriptlet tags.
- When true, EJS will use an async function for rendering. (Dependsincluder
on async/await support in the JS runtime).
- Custom function to handle EJS includes, receives (originalPath, parsedPath)originalPath
parameters, where is the path in include as-is and parsedPath is the{ filename, template }
previously resolved path. Should return an object ,filename
you may return only one of the properties, where is the final parsed path and template
is the included content.
This project uses JSDoc. For the full public API
documentation, clone the repository and run jake doc. This will run JSDocout/
with the proper options and output the documentation to . If you wantjake devdoc
the both the public & private API docs, run instead.
- <% 'Scriptlet' tag, for control-flow, no output<%_
- 'Whitespace Slurping' Scriptlet tag, strips all whitespace before it<%=
- Outputs the value into the template (escaped)<%-
- Outputs the unescaped value into the template<%#
- Comment tag, no execution, no output<%%
- Outputs a literal '<%'%%>
- Outputs a literal '%>'%>
- Plain ending tag-%>
- Trim-mode ('newline slurp') tag, trims following newline_%>
- 'Whitespace Slurping' ending tag, removes all whitespace after it
For the full syntax documentation, please see docs/syntax.md.
Includes either have to be an absolute path, or, if not, are assumed as
relative to the template with the include call. For example if you are./views/user/show.ejs
including from ./views/users.ejs you would<%- include('user/show') %>
use .
You must specify the filename option for the template with the includerenderFile()
call unless you are using .
You'll likely want to use the raw output tag (<%-) with your include to avoid
double-escaping the HTML output.
`ejs`
<% users.forEach(function(user){ %>
<%- include('user/show', {user: user}) %>
<% }); %>
Includes are inserted at runtime, so you can use variables for the path in the
include call (for example <%- include(somePath) %>). Variables in your
top-level data object are available to all your includes, but local variables
need to be passed down.
NOTE: Include preprocessor directives (<% include user/show %>) are
not supported in v3.0+.
Custom delimiters can be applied on a per-template basis, or globally:
`javascript
import ejs from 'ejs';
const users = ['geddy', 'neil', 'alex'];
// Just one template
ejs.render('
[?= users.join(" | "); ?]
', {users: users}, {delimiter: '?', openDelimiter: '[', closeDelimiter: ']'});geddy | neil | alex
'// Or globally
ejs.delimiter = '?';
ejs.openDelimiter = '[';
ejs.closeDelimiter = ']';
ejs.render('
[?= users.join(" | "); ?]
', {users: users});geddy | neil | alex
'$3
EJS ships with a basic in-process cache for caching the intermediate JavaScript
functions used to render templates. It's easy to plug in LRU caching using
Node's
lru-cache library:`javascript
import ejs from 'ejs';
import { LRUCache } from 'lru-cache';ejs.cache = LRUCache({max: 100}); // LRU cache with 100-item limit
`If you want to clear the EJS cache, call
ejs.clearCache. If you're using the
LRU cache and need a different limit, simple reset ejs.cache to a new instance
of the LRU.$3
The default file loader is
fs.readFileSync, if you want to customize it, you can set ejs.fileLoader.`javascript
import ejs from 'ejs';const myFileLoad = function (filePath) {
return 'myFileLoad: ' + fs.readFileSync(filePath);
};
ejs.fileLoader = myFileLoad;
`With this feature, you can preprocess the template before reading it.
$3
EJS does not specifically support blocks, but layouts can be implemented by
including headers and footers, like so:
`ejs
<%- include('header') -%>
Title
My page
<%- include('footer') -%>
`Client-side support
Go to the Latest Release, download
./ejs.js or ./ejs.min.js. Alternately, you can compile it yourself by cloning
the repository and running jake build (or npx jake build if jake is
not installed globally).Include one of these files on your page, and
ejs should be available globally.$3
`html
`$3
Most of EJS will work as expected; however, there are a few things to note:
1. Obviously, since you do not have access to the filesystem,
ejs.renderFile() won't work.
2. For the same reason, includes do not work unless you use an include callback. Here is an example:
`javascript
let str = "Hello <%= include('file', {person: 'John'}); %>",
fn = ejs.compile(str, {client: true}); fn(data, null, function(path, d){ // include callback
// path -> 'file'
// d -> {person: 'John'}
// Put your code here
// Return the contents of file as a string
}); // returns rendered string
`See the examples folder for more details.
CLI
EJS ships with a full-featured CLI. Options are similar to those used in JavaScript code:
-
-o / --output-file FILE Write the rendered output to FILE rather than stdout.
- -f / --data-file FILE Must be JSON-formatted. Use parsed input from FILE as data for rendering.
- -i / --data-input STRING Must be JSON-formatted and URI-encoded. Use parsed input from STRING as data for rendering.
- -m / --delimiter CHARACTER Use CHARACTER with angle brackets for open/close (defaults to %).
- -p / --open-delimiter CHARACTER Use CHARACTER instead of left angle bracket to open.
- -c / --close-delimiter CHARACTER Use CHARACTER instead of right angle bracket to close.
- -s / --strict When set to true, generated function is in strict mode
- -n / --no-with Use 'locals' object for vars rather than using with (implies --strict).
- -l / --locals-name Name to use for the object storing local variables when not using with.
- -w / --rm-whitespace Remove all safe-to-remove whitespace, including leading and trailing whitespace.
- -d / --debug Outputs generated function body
- -h / --help Display this help message.
- -V/v / --version Display the EJS version.Here are some examples of usage:
`shell
$ ejs -p [ -c ] ./template_file.ejs -o ./output.html
$ ejs ./test/fixtures/user.ejs name=Lerxst
$ ejs -n -l _ ./some_template.ejs -f ./data_file.json
`$3
There is a variety of ways to pass the CLI data for rendering.
Stdin:
`shell
$ ./test/fixtures/user_data.json | ejs ./test/fixtures/user.ejs
$ ejs ./test/fixtures/user.ejs < test/fixtures/user_data.json
`A data file:
`shell
$ ejs ./test/fixtures/user.ejs -f ./user_data.json
`A command-line option (must be URI-encoded):
`shell
./bin/cli.js -i %7B%22name%22%3A%20%22foo%22%7D ./test/fixtures/user.ejs
`Or, passing values directly at the end of the invocation:
`shell
./bin/cli.js -m $ ./test/fixtures/user.ejs name=foo
`$3
The CLI by default send output to stdout, but you can use the
-o or --output-file`VSCode:Javascript EJS by DigitalBrainstem
There are a number of implementations of EJS:
* TJ's implementation, the v1 of this library: https://github.com/tj/ejs
* EJS Embedded JavaScript Framework on Google Code: https://code.google.com/p/embeddedjavascript/
* Sam Stephenson's Ruby implementation: https://rubygems.org/gems/ejs
* Erubis, an ERB implementation which also runs JavaScript: http://www.kuwata-lab.com/erubis/users-guide.04.html#lang-javascript
* DigitalBrainstem EJS Language support: https://github.com/Digitalbrainstem/ejs-grammar
Licensed under the Apache License, Version 2.0
(
- - -
EJS Embedded JavaScript templates copyright 2112
mde@fleegix.org.