You are an administrator.
\n// <% } else { %>\n//Welcome, regular user.
\n// <% } %>\n//Current time: <%= currentTime.toLocaleTimeString() %>
\n// \n// \n\n// Route to render a template file\napp.get('/', (req, res) => {\n const userData = {\n user: { name: 'Alice' },\n isAdmin: true,\n currentTime: new Date()\n };\n res.render('index', userData);\n});\n\n// Route to render a template string directly\napp.get('/direct', (req, res) => {\n const templateString = `Server says: <%= message %>
`;\n const data = { message: 'Hello from direct EJS render!' };\n const html = ejs.render(templateString, data);\n res.send(html);\n});\n\napp.listen(port, () => {\n console.log(`EJS example app listening at http://localhost:${port}`);\n console.log(`Try http://localhost:${port}/ and http://localhost:${port}/direct`);\n});\n","lang":"typescript","description":"This quickstart demonstrates setting up EJS with an Express application to render templates from files and also shows how to render EJS template strings directly using `ejs.render`."},"warnings":[{"fix":"Always use the explicit form `ejs.render(templateString, dataObject, optionsObject)` to clearly separate your template data from EJS rendering options.","message":"The shortcut `ejs.render(dataAndOptions)` where all template data and rendering options are passed in a single object is officially deprecated and not recommended. It was effectively removed as a reliable pattern starting from v3.0.0 due to potential conflicts if an internal option name clashes with a data property name, leading to unpredictable behavior.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Migrate away from `ejs.filters`. Implement custom logic as helper functions passed directly within your template data, or preprocess your data before rendering to apply transformations.","message":"The `ejs.filters` object, which provided a global mechanism for defining custom filter functions, was removed in EJS v4.0.0. Any code relying on `ejs.filters` will no longer function.","severity":"breaking","affected_versions":">=4.0.0"},{"fix":"If dynamic cache clearing is a critical requirement, you may need to reconsider your application's caching strategy, potentially by managing template compilation and caching manually or at a higher application level.","message":"The `ejs.clearCache()` method, which allowed programmatic clearing of EJS's internal template cache, was removed in EJS v5.0.0. There is no direct public API to clear the cache anymore.","severity":"breaking","affected_versions":">=5.0.0"},{"fix":"NEVER pass unsanitized user input directly to EJS template rendering functions or configuration options. Always rigorously validate and sanitize all external input. Treat any user-supplied template content as hostile and potentially malicious.","message":"EJS templates are essentially JavaScript runtimes. Directly passing unchecked user input (e.g., from `req.query`, `req.body`, or `req.params`) as the template string or influencing sensitive options like `filename`, `root`, or `closeDelimiter` can lead to severe Server-Side Template Injection (SSTI) and Remote Code Execution (RCE) vulnerabilities. The EJS project explicitly warns against this, stating that the `render` function is not intended for untrusted input.","severity":"gotcha","affected_versions":">=0.12.18"},{"fix":"When using `strict: true` or `_with: false`, ensure all variables in your template are prefixed with `locals.` (e.g., `<%= locals.variableName %>`). Alternatively, explicitly set `_with: true` and `strict: false` if direct variable access is preferred and you understand the implications.","message":"By default, EJS uses JavaScript's `with()` statement (`_with: true`) to expose local variables directly in the template scope. However, when `strict: true` is enabled or `_with: false` is explicitly set, `with()` is not used. In these scenarios, template variables must be accessed via a `locals` object (e.g., `<%= locals.user.name %>` instead of `<%= user.name %>`), otherwise, a `ReferenceError` will occur.","severity":"gotcha","affected_versions":">=3.0.0"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"In your template, change `<%= variable_name %>` to `<%= locals.variable_name %>`. Alternatively, ensure `strict: false` and `_with: true` are set in your EJS rendering options if direct variable access is desired.","cause":"This typically occurs when EJS is running in strict mode (`strict: true`) or with `_with: false`, and template variables are accessed directly instead of through the `locals` object.","error":"ReferenceError: