mitsuhiko/flask — pull request #1176 by alanhamlett (2014-09-14 19:10:31+00:00)
Title: turn on autoescape for `flask.templating.render_template_string`

This seems like a sane default, since Flask turns on autoescape by default for html files when using the more common `render_template` so users will be expecting `render_template_string` to autoescape their template variables.