ssjs.guide SFMC

TreatAsContent

→ string

Evaluates a string containing AMPscript or HTML on the SFMC server and returns the rendered result. Security warning — never pass unvalidated user input.

Available in: Email CloudPage Automation Triggered Send

Syntax

TreatAsContent(content)
1 argument

Parameters

Name Type Required Description
content string Yes String containing AMPscript or HTML to evaluate server-side.

Description

TreatAsContent() submits a string to the SFMC template rendering engine for evaluation. Any AMPscript or HTML in the string is processed and the result returned.

This is primarily used to invoke AMPscript functions from SSJS context — functions like EncryptSymmetric, DecryptSymmetric, URLEncode (with encoding options), and others that have no direct SSJS equivalent.

Security warning: Never pass user-supplied input directly to TreatAsContent(). Since it evaluates AMPscript, an attacker could inject AMPscript code that reads Data Extensions, subscriber attributes, or other sensitive data. Always use Variable.SetValue() to safely pass values into an AMPscript expression.

The Safe Pattern

// ❌ Unsafe — user input could contain AMPscript
var userInput = Platform.Request.GetFormData("name");
TreatAsContent("%%[Set @result = Format(@userInput)]%%");

// ✅ Safe — set the value via Variable.SetValue first, reference by variable name
Variable.SetValue("@inputVal", userInput);
TreatAsContent("%%[Set @result = Format(@inputVal, \"text\")]%%");
var result = Variable.GetValue("@result");

Examples

Call AMPscript functions unavailable in SSJS

// Decrypt a value using AMPscript's DecryptSymmetric
Variable.SetValue("@encryptedValue", encryptedString);
TreatAsContent(
    '%%[Set @decrypted = DecryptSymmetric(@encryptedValue, "AES", ' +
    '@empty, "myPassword", @empty, "mySalt", @empty, "myIV")]%%'
);
var decrypted = Variable.GetValue("@decrypted");

URLEncode with extra options

Variable.SetValue("@valueToEncode", myValue);
TreatAsContent("%%[Set @encoded = URLEncode(@valueToEncode, 1, 1)]%%");
var encoded = Variable.GetValue("@encoded");

Execute complex AMPscript logic

Variable.SetValue("@subscriberKey", sk);
TreatAsContent(
    "%%[" +
    "  Set @email = Lookup('Subscribers', 'Email', 'SubscriberKey', @subscriberKey) " +
    "  Set @isVIP = Lookup('VIPList', 'IsVIP', 'Email', @email) " +
    "]%%"
);
var email = Variable.GetValue("@email");
var isVIP = Variable.GetValue("@isVIP");

Notes

The global TreatAsContent() is identical to Platform.Function.TreatAsContent(). It doesn’t return the rendered output — use Variable.GetValue() to retrieve values set inside the AMPscript block.

ESLint rule: sfmc/ssjs-no-treatascontent-injection warns when the argument to TreatAsContent contains string concatenation with variables (injection risk).

See Also

See Also