python - Django: saving data from user input and display -

i have form jwysiwyg editor. looking @ it, can use basic-formatting html tags using formatting buttons so's. upon submitting form, notice saved database as-is, whereas if enter stuff <iframe> ... </iframe> editor notice html-encoded inside table.

now, when need output whatever user has submitted, can safely use {{ output|safe }} display formatted text?

is reasonably secure enough or how should rectify?

use safe filter if html-escape data first. otherwise should use escape. if want users able input data html tags try sanitize input prevent users using <iframe>, <script>, etc, allow other tags white-listed, , mark safe.