After reading the document, the function of mark_safe() is still unclear. I guess it is related to CSRF stuff. But why and when shall the mark_safe() be used?
Here is the documentation
mark_safe(s)
Explicitly mark a string as safe for (HTML) output purposes. The returned object can be used everywhere a string or unicode object is appropriate.
Can be called multiple times on a single string.
For building up fragments of HTML, you should normally be using django.utils.html.format_html() instead.
String marked safe will become unsafe again if modified. For example: