The Core Syntax: Your Toolkit
<%= %>
Output Data (Escaped)
Your go-to tag. Safely outputs data as text, preventing security risks by escaping HTML. Perfect for user-generated content.
<%- %>
Output Raw HTML
Outputs unescaped data. Use with caution! Only for trusted content, like rendering an EJS partial with `<%- include() %>`.
<% %>
Execute Logic
The "scriptlet" tag. Use it for conditionals (`if/else`), loops (`forEach`), and defining variables. It runs the code but outputs nothing.
<%# %>
Comments
Server-side comments. They are stripped from the final HTML output, making them perfect for developer notes inside templates.
EJS in Action: The Express Render Cycle
When a user requests a page, Express follows a simple flow to combine your data and templates into a complete HTML document, which is then sent back to the browser.
Common EJS Feature Usage
This chart shows a typical breakdown of how developers use EJS features. Outputting data is the primary task, followed by control flow and reusing UI with partials.
EJS Best Practices, Ranked
Prioritizing security and keeping logic out of views are the most critical best practices for writing clean, maintainable, and secure EJS applications.
Professional Workflows
Security First
Always default to `<%= %>` to prevent XSS attacks. Treat all user input as untrusted and let EJS's default escaping protect your application.
Performance by Default
EJS automatically caches compiled templates in production. This means blazing-fast renders after the first request with zero configuration.
Structured Views
Organize your templates into `pages/` and `partials/` directories. A clean structure is key to managing large, scalable applications.