{{extend 'layout.html'}}

Strings are automatically escaped

Message is

{{=message}}