diff --git a/cms/djangoapps/contentstore/tasks.py b/cms/djangoapps/contentstore/tasks.py
index 1c125f0156..2e247e1042 100644
--- a/cms/djangoapps/contentstore/tasks.py
+++ b/cms/djangoapps/contentstore/tasks.py
@@ -199,7 +199,7 @@ def enqueue_async_migrate_transcripts_tasks(course_keys,
         'command_run': command_run
     }
     group([
-        async_migrate_transcript.s(unicode(course_key), **kwargs)
+        async_migrate_transcript.s(text_type(course_key), **kwargs)
         for course_key in course_keys
     ])()
 
@@ -266,7 +266,7 @@ def async_migrate_transcript(self, course_key, **kwargs):   # pylint: disable=un
                 all_transcripts.update({'en': video.sub})
 
             sub_tasks = []
-            video_location = unicode(video.location)
+            video_location = text_type(video.location)
             for lang in all_transcripts:
                 sub_tasks.append(async_migrate_transcript_subtask.s(
                     video_location, revision, lang, force_update, **kwargs
diff --git a/cms/djangoapps/contentstore/views/component.py b/cms/djangoapps/contentstore/views/component.py
index 1228b724e2..ed75ccd25b 100644
--- a/cms/djangoapps/contentstore/views/component.py
+++ b/cms/djangoapps/contentstore/views/component.py
@@ -1,6 +1,7 @@
 from __future__ import absolute_import
 
 import logging
+import six
 
 from django.conf import settings
 from django.contrib.auth.decorators import login_required
@@ -130,9 +131,10 @@ def container_handler(request, usage_key_string):
 
             assert unit is not None, "Could not determine unit page"
             subsection = get_parent_xblock(unit)
-            assert subsection is not None, "Could not determine parent subsection from unit " + unicode(unit.location)
+            assert subsection is not None, "Could not determine parent subsection from unit " + six.text_type(
+                unit.location)
             section = get_parent_xblock(subsection)
-            assert section is not None, "Could not determine ancestor section from unit " + unicode(unit.location)
+            assert section is not None, "Could not determine ancestor section from unit " + six.text_type(unit.location)
 
             # Fetch the XBlock info for use by the container page. Note that it includes information
             # about the block's ancestors and siblings for use by the Unit Outline.
diff --git a/cms/djangoapps/contentstore/views/library.py b/cms/djangoapps/contentstore/views/library.py
index f26b3dca93..a9bdc0dace 100644
--- a/cms/djangoapps/contentstore/views/library.py
+++ b/cms/djangoapps/contentstore/views/library.py
@@ -106,13 +106,13 @@ def _display_library(library_key_string, request):
     if not has_studio_read_access(request.user, library_key):
         log.exception(
             u"User %s tried to access library %s without permission",
-            request.user.username, unicode(library_key)
+            request.user.username, text_type(library_key)
         )
         raise PermissionDenied()
 
     library = modulestore().get_library(library_key)
     if library is None:
-        log.exception(u"Library %s not found", unicode(library_key))
+        log.exception(u"Library %s not found", text_type(library_key))
         raise Http404
 
     response_format = 'html'
@@ -132,7 +132,7 @@ def _list_libraries(request):
     lib_info = [
         {
             "display_name": lib.display_name,
-            "library_key": unicode(lib.location.library_key),
+            "library_key": text_type(lib.location.library_key),
         }
         for lib in modulestore().get_libraries()
         if has_studio_read_access(request.user, lib.location.library_key)
@@ -182,7 +182,7 @@ def _create_library(request):
             )
         })
 
-    lib_key_str = unicode(new_lib.location.library_key)
+    lib_key_str = text_type(new_lib.location.library_key)
     return JsonResponse({
         'url': reverse_library_url('library_handler', lib_key_str),
         'library_key': lib_key_str,
@@ -208,10 +208,10 @@ def library_blocks_view(library, user, response_format):
         prev_version = library.runtime.course_entry.structure['previous_version']
         return JsonResponse({
             "display_name": library.display_name,
-            "library_id": unicode(library.location.library_key),
-            "version": unicode(library.runtime.course_entry.course_key.version_guid),
-            "previous_version": unicode(prev_version) if prev_version else None,
-            "blocks": [unicode(x) for x in children],
+            "library_id": text_type(library.location.library_key),
+            "version": text_type(library.runtime.course_entry.course_key.version_guid),
+            "previous_version": text_type(prev_version) if prev_version else None,
+            "blocks": [text_type(x) for x in children],
         })
 
     can_edit = has_studio_write_access(user, library.location.library_key)
@@ -261,7 +261,7 @@ def manage_library_users(request, library_key_string):
         'context_library': library,
         'users': formatted_users,
         'allow_actions': bool(user_perms & STUDIO_EDIT_ROLES),
-        'library_key': unicode(library_key),
+        'library_key': text_type(library_key),
         'lib_users_url': reverse_library_url('manage_library_users', library_key_string),
         'show_children_previews': library.show_children_previews
     })
diff --git a/cms/djangoapps/contentstore/views/preview.py b/cms/djangoapps/contentstore/views/preview.py
index 2c4694c691..68a26fb9ba 100644
--- a/cms/djangoapps/contentstore/views/preview.py
+++ b/cms/djangoapps/contentstore/views/preview.py
@@ -2,6 +2,7 @@ from __future__ import absolute_import
 
 import logging
 from functools import partial
+import six
 
 from django.conf import settings
 from django.contrib.auth.decorators import login_required
@@ -101,7 +102,7 @@ class PreviewModuleSystem(ModuleSystem):  # pylint: disable=abstract-method
 
     def handler_url(self, block, handler_name, suffix='', query='', thirdparty=False):
         return reverse('preview_handler', kwargs={
-            'usage_key_string': unicode(block.scope_ids.usage_id),
+            'usage_key_string': six.text_type(block.scope_ids.usage_id),
             'handler': handler_name,
             'suffix': suffix,
         }) + '?' + query
@@ -166,7 +167,7 @@ def _preview_module_system(request, descriptor, field_data):
             wrap_xblock,
             'PreviewRuntime',
             display_name_only=display_name_only,
-            usage_id_serializer=unicode,
+            usage_id_serializer=six.text_type,
             request_token=request_token(request)
         ),
 
@@ -180,7 +181,7 @@ def _preview_module_system(request, descriptor, field_data):
         partial(
             wrap_xblock_aside,
             'PreviewRuntime',
-            usage_id_serializer=unicode,
+            usage_id_serializer=six.text_type,
             request_token=request_token(request)
         )
     ]
diff --git a/cms/templates/checklists.html b/cms/templates/checklists.html
index 6c6bf24643..7bc7fd0f01 100644
--- a/cms/templates/checklists.html
+++ b/cms/templates/checklists.html
@@ -2,6 +2,8 @@
 <%inherit file="base.html" />
 <%def name="online_help_token()"><% return "files" %></%def>
 <%!
+  import six
+
   from cms.djangoapps.contentstore import utils
   from cms.djangoapps.contentstore.config.waffle_utils import should_show_checklists_quality
   from django.core.urlresolvers import reverse
@@ -38,7 +40,7 @@
         <%static:studiofrontend entry="courseHealthCheck">
 
             <%
-                course_key = unicode(context_course.id)
+                course_key = six.text_type(context_course.id)
                 certificates_url = ''
                 if has_certificates_enabled(context_course):
                     certificates_url = utils.reverse_course_url('certificates_list_handler', course_key)
diff --git a/cms/templates/course_outline.html b/cms/templates/course_outline.html
index 5507ed75fa..a321f75627 100644
--- a/cms/templates/course_outline.html
+++ b/cms/templates/course_outline.html
@@ -3,6 +3,8 @@
 <%def name="online_help_token()"><% return "develop_course" %></%def>
 <%!
 import logging
+import six
+
 from cms.djangoapps.contentstore.config.waffle_utils import should_show_checklists_quality
 from util.date_utils import get_default_time_display
 from django.utils.translation import ugettext as _
@@ -185,7 +187,7 @@ from django.core.urlresolvers import reverse
                             },
                             "enable_quality": ${should_show_checklists_quality(context_course.id) | n, dump_js_escaped_json},
                             "links": {
-                                "settings": ${reverse('settings_handler', kwargs={'course_key_string': unicode(course_key)})| n, dump_js_escaped_json}
+                                "settings": ${reverse('settings_handler', kwargs={'course_key_string': six.text_type(course_key)})| n, dump_js_escaped_json}
                             }
                         }
                     </%static:studiofrontend> 
diff --git a/cms/templates/export_git.html b/cms/templates/export_git.html
index 65c8c3e08b..d18a231862 100644
--- a/cms/templates/export_git.html
+++ b/cms/templates/export_git.html
@@ -3,6 +3,8 @@
 <%namespace name='static' file='static_content.html'/>
 
 <%!
+  import six
+
   from django.urls import reverse
   from django.utils.translation import ugettext as _
 %>
@@ -39,7 +41,7 @@
         % else:
         <ul class="list-actions">
           <li class="item-action">
-            <a class="action action-export-git action-primary" href="${reverse('export_git', kwargs=dict(course_key_string=unicode(context_course.id)))}?action=push">
+            <a class="action action-export-git action-primary" href="${reverse('export_git', kwargs=dict(course_key_string=six.text_type(context_course.id)))}?action=push">
               <span class="icon fa fa-arrow-circle-o-down" aria-hidden="true"></span>
               <span class="copy">${_("Export to Git")}</span>
             </a>
diff --git a/cms/templates/manage_users.html b/cms/templates/manage_users.html
index 50b7a9e3df..580a313dc3 100644
--- a/cms/templates/manage_users.html
+++ b/cms/templates/manage_users.html
@@ -1,5 +1,8 @@
+## xss-lint: disable=mako-missing-default
 <%inherit file="base.html" />
 <%!
+import six
+
 from django.utils.translation import ugettext as _
 from django.urls import reverse
 
@@ -106,6 +109,7 @@ from openedx.core.djangolib.js_utils import (
       % if show_transfer_ownership_hint:
       <div class="bit">
         <h3 class="title-3">${_("Transferring Ownership")}</h3>
+        # xss-lint: disable=python-wrap-html
         <p>${_("Every course must have an Admin. If you are the Admin and you want to transfer ownership of the course, click <strong>Add admin access</strong> to make another user the Admin, then ask that user to remove you from the Course Team list.")}</p>
       </div>
       % endif
@@ -117,9 +121,11 @@ from openedx.core.djangolib.js_utils import (
 <%block name="requirejs">
   require(["js/factories/manage_users"], function(ManageCourseUsersFactory) {
       ManageCourseUsersFactory(
+        // xss-lint: disable=mako-invalid-js-filter
         "${context_course.display_name_with_default | h}",
         ${users | n, dump_js_escaped_json},
-        "${reverse('course_team_handler', kwargs={'course_key_string': unicode(context_course.id), 'email': '@@EMAIL@@'}) | n, js_escaped_string}",
+        // xss-lint: disable=mako-invalid-js-filter
+        "${reverse('course_team_handler', kwargs={'course_key_string': six.text_type(context_course.id), 'email': '@@EMAIL@@'}) | n, js_escaped_string}",
         ${request.user.id | n, dump_js_escaped_json},
         ${allow_actions | n, dump_js_escaped_json}
       );
diff --git a/common/lib/xmodule/xmodule/tests/test_vertical.py b/common/lib/xmodule/xmodule/tests/test_vertical.py
index 765450f17f..7ceb28eeef 100644
--- a/common/lib/xmodule/xmodule/tests/test_vertical.py
+++ b/common/lib/xmodule/xmodule/tests/test_vertical.py
@@ -7,6 +7,7 @@ from __future__ import absolute_import, division, print_function, unicode_litera
 
 from collections import namedtuple
 import json
+import six
 
 import ddt
 from fs.memoryfs import MemoryFS
@@ -113,7 +114,7 @@ class VerticalBlockTestCase(BaseVerticalBlockTest):
         Assert content has/hasn't all the bookmark info.
         """
         assertion('bookmark_id', content)
-        assertion('{},{}'.format(self.username, unicode(self.vertical.location)), content)
+        assertion('{},{}'.format(self.username, six.text_type(self.vertical.location)), content)
         assertion('bookmarked', content)
         assertion('show_bookmark_button', content)
 
diff --git a/lms/djangoapps/discussion/templates/discussion/discussion_board_js.template b/lms/djangoapps/discussion/templates/discussion/discussion_board_js.template
index 13b661d541..b23082c49d 100644
--- a/lms/djangoapps/discussion/templates/discussion/discussion_board_js.template
+++ b/lms/djangoapps/discussion/templates/discussion/discussion_board_js.template
@@ -1,6 +1,8 @@
 ## mako
 
 <%!
+import six
+
 from openedx.core.djangolib.js_utils import dump_js_escaped_json, js_escaped_string
 %>
 
@@ -46,7 +48,7 @@ from openedx.core.djangolib.js_utils import dump_js_escaped_json, js_escaped_str
     $(function() {
         require(['discussion/js/discussion_board_factory'], function (DiscussionBoardFactory) {
             DiscussionBoardFactory({
-                courseId: '${unicode(course.id) | n, js_escaped_string}',
+                courseId: '${six.text_type(course.id) | n, js_escaped_string}',
                 $el: $(".discussion-board"),
                 rootUrl: '${root_url | n, js_escaped_string}',
                 userInfo: ${user_info | n, dump_js_escaped_json},
diff --git a/lms/djangoapps/discussion/templates/discussion/discussion_profile_page.html b/lms/djangoapps/discussion/templates/discussion/discussion_profile_page.html
index ca3bdf9059..4a58170257 100644
--- a/lms/djangoapps/discussion/templates/discussion/discussion_profile_page.html
+++ b/lms/djangoapps/discussion/templates/discussion/discussion_profile_page.html
@@ -6,6 +6,8 @@
 
 <%!
 import json
+import six
+
 from django.utils.translation import ugettext as _, ungettext
 from django.template.defaultfilters import escapejs
 from django.urls import reverse
@@ -19,7 +21,7 @@ from openedx.core.djangolib.js_utils import dump_js_escaped_json, js_escaped_str
 <%static:require_module module_name="discussion/js/discussion_profile_page_factory" class_name="DiscussionProfilePageFactory">
     profile_page_context = {
         'courseSettings': ${course_settings | n, dump_js_escaped_json},
-        'courseId': '${unicode(course.id) | n, js_escaped_string}',
+        'courseId': '${six.text_type(course.id) | n, js_escaped_string}',
         'courseName': '${course.display_name_with_default | n, js_escaped_string}',
         'contentInfo': ${annotated_content_info | n, dump_js_escaped_json},
         'userInfo': ${user_info | n, dump_js_escaped_json},
diff --git a/lms/djangoapps/teams/templates/teams/teams.html b/lms/djangoapps/teams/templates/teams/teams.html
index 9482ea8b8d..5b0a885a75 100644
--- a/lms/djangoapps/teams/templates/teams/teams.html
+++ b/lms/djangoapps/teams/templates/teams/teams.html
@@ -4,6 +4,8 @@
 
 <%! import json %>
 <%!
+import six
+
 from django.utils.translation import ugettext as _
 from openedx.core.djangolib.js_utils import (
     dump_js_escaped_json, js_escaped_string
@@ -39,7 +41,7 @@ from openedx.core.djangolib.js_utils import (
 
 <%static:require_module module_name="teams/js/teams_tab_factory" class_name="TeamsTabFactory">
     TeamsTabFactory({
-        courseID: '${unicode(course.id) | n, js_escaped_string}',
+        courseID: '${six.text_type(course.id) | n, js_escaped_string}',
         topics: ${topics | n, dump_js_escaped_json},
         userInfo: ${user_info | n, dump_js_escaped_json},
         topicUrl: '${topic_url | n, js_escaped_string}',
diff --git a/lms/templates/courseware/course_about.html b/lms/templates/courseware/course_about.html
index c1412399f0..3eea1aedc5 100644
--- a/lms/templates/courseware/course_about.html
+++ b/lms/templates/courseware/course_about.html
@@ -273,7 +273,7 @@ from six import string_types
           %endif
 
           % if pre_requisite_courses:
-          <% prc_target = reverse('about_course', args=[unicode(pre_requisite_courses[0]['key'])]) %>
+          <% prc_target = reverse('about_course', args=[text_type(pre_requisite_courses[0]['key'])]) %>
           <li class="prerequisite-course important-dates-item">
             <span class="icon fa fa-list-ul" aria-hidden="true"></span>
             <p class="important-dates-item-title">${_("Prerequisites")}</p>
diff --git a/lms/templates/courseware/courseware.html b/lms/templates/courseware/courseware.html
index c85bd59d54..3cb573538e 100644
--- a/lms/templates/courseware/courseware.html
+++ b/lms/templates/courseware/courseware.html
@@ -3,6 +3,7 @@
 <%namespace name='static' file='/static_content.html'/>
 <%def name="online_help_token()"><% return "courseware" %></%def>
 <%!
+import six
 import waffle
 
 from django.conf import settings
@@ -178,13 +179,13 @@ ${HTML(fragment.foot_html())}
                             % endif
                             % if chapter:
                                 <span class="nav-item nav-item-chapter" data-course-position="${course.position}" data-chapter-position="${chapter.position}">
-                                    <a href="${course_url}#${unicode(chapter.location)}">${chapter.display_name_with_default}</a>
+                                    <a href="${course_url}#${six.text_type(chapter.location)}">${chapter.display_name_with_default}</a>
                                 </span>
                                 <span class="icon fa fa-angle-right" aria-hidden="true"></span>
                             % endif
                             % if section:
                                 <span class="nav-item nav-item-section">
-                                    <a href="${course_url}#${unicode(section.location)}">${section.display_name_with_default}</a>
+                                    <a href="${course_url}#${six.text_type(section.location)}">${section.display_name_with_default}</a>
                                 </span>
                                 <span class="icon fa fa-angle-right" aria-hidden="true"></span>
                             % endif
diff --git a/lms/templates/courseware/progress.html b/lms/templates/courseware/progress.html
index 55895e5ed8..240fa51c8b 100644
--- a/lms/templates/courseware/progress.html
+++ b/lms/templates/courseware/progress.html
@@ -73,7 +73,7 @@ username = get_enterprise_learner_generic_name(request) or student.username
                         %if certificate_data:
                         <div class="auto-cert-message" id="course-success">
                             <div class="has-actions">
-                                <% post_url = reverse('generate_user_cert', args=[unicode(course.id)]) %>
+                                <% post_url = reverse('generate_user_cert', args=[text_type(course.id)]) %>
                                 <div class="msg-content">
                                     <h4 class="hd hd-4 title">${_(certificate_data.title)}</h4>
                                     <p class="copy">${_(certificate_data.msg)}</p>
diff --git a/lms/templates/courseware/xqa_interface.html b/lms/templates/courseware/xqa_interface.html
index b4a2fe4cc9..df6035acad 100644
--- a/lms/templates/courseware/xqa_interface.html
+++ b/lms/templates/courseware/xqa_interface.html
@@ -1,4 +1,8 @@
+## xss-lint: disable=mako-missing-default
 <%namespace name='static' file='/static_content.html'/>
+<%!
+import six
+%>
 
 <script type="text/javascript" src="${static.url('js/vendor/jquery.leanModal.js')}"></script>
 <script type="text/javascript" src="${static.url('js/staff_debug_actions.js')}"></script>
@@ -23,8 +27,8 @@ function setup_debug(element_id, edit_link, staff_context){
         function () {
             var username = $("#" + element_id + "_history_student_username").val();
             var location = $("#" + element_id + "_history_location").val();
-
-            $("#" + element_id + "_history_text").load('/courses/' + "${unicode(course.id) | u}" +
+            // xss-lint: disable=mako-invalid-js-filter
+            $("#" + element_id + "_history_text").load('/courses/' + "${six.text_type(course.id) | u}" +
                 "/submission_history/" + username + "/" + location);
             return false;
         }
@@ -71,6 +75,7 @@ function sendlog(element_id, edit_link, staff_context){
         };
 
     $.ajax({
+        //# xss-lint: disable=mako-invalid-js-filter
         url: '${xqa_server}/log',
         type: 'GET',
         contentType: 'application/json',
@@ -81,6 +86,7 @@ function sendlog(element_id, edit_link, staff_context){
             xhr.setRequestHeader ("Authorization", "Basic eHFhOmFnYXJ3YWw="); },
         timeout : 1000,
         success: function(result) {
+                // xss-lint: disable=javascript-jquery-html
                 $('#' + element_id + '_xqa_log_data').html(result);
         },
         error: function() {
@@ -100,6 +106,7 @@ function getlog(element_id, staff_context){
     };
 
     $.ajax({
+        // xss-lint: disable=mako-invalid-js-filter
         url: '${xqa_server}/query',
         type: 'GET',
         contentType: 'application/json',
@@ -108,6 +115,7 @@ function getlog(element_id, staff_context){
         dataType: 'jsonp',
         timeout : 1000,
         success: function(result) {
+            // xss-lint: disable=javascript-jquery-html
             $('#' + element_id + '_xqa_log_data').html(result);
         },
         error: function() {
diff --git a/lms/templates/dashboard.html b/lms/templates/dashboard.html
index 6451c814b0..2326481a7b 100644
--- a/lms/templates/dashboard.html
+++ b/lms/templates/dashboard.html
@@ -4,6 +4,7 @@
 <%namespace name='static' file='static_content.html'/>
 <%!
 import pytz
+import six
 from datetime import datetime, timedelta
 from django.urls import reverse
 from django.utils.translation import ugettext as _
@@ -199,7 +200,7 @@ from student.models import CourseEnrollment
                 is_course_blocked = (session_id in block_courses)
                 course_verification_status = verification_status_by_course.get(session_id, {})
                 course_requirements = courses_requirements_not_met.get(session_id)
-                related_programs = inverted_programs.get(unicode(entitlement.course_uuid if is_unfulfilled_entitlement else session_id))
+                related_programs = inverted_programs.get(six.text_type(entitlement.course_uuid if is_unfulfilled_entitlement else session_id))
                 show_consent_link = (session_id in consent_required_courses)
                 course_overview = enrollment.course_overview
                 resume_button_url = resume_button_urls[dashboard_index]
diff --git a/lms/templates/dashboard/_dashboard_course_listing.html b/lms/templates/dashboard/_dashboard_course_listing.html
index 44c7861c18..f58dfaa621 100644
--- a/lms/templates/dashboard/_dashboard_course_listing.html
+++ b/lms/templates/dashboard/_dashboard_course_listing.html
@@ -63,7 +63,7 @@ from util.course import get_link_for_about_page, get_encoded_course_sharing_utm_
         % endif
       >
 <article class="course${mode_class}" aria-labelledby="course-title-${enrollment.course_id}" id="course-card-${course_card_index}">
-  <% course_target = reverse(course_home_url_name(course_overview.id), args=[unicode(course_overview.id)]) %>
+  <% course_target = reverse(course_home_url_name(course_overview.id), args=[six.text_type(course_overview.id)]) %>
   <section class="details" aria-labelledby="details-heading-${enrollment.course_id}">
       <h2 class="hd hd-2 sr" id="details-heading-${enrollment.course_id}">${_('Course details')}</h2>
     <div class="wrapper-course-image" aria-hidden="true">
@@ -286,7 +286,7 @@ from util.course import get_link_for_about_page, get_encoded_course_sharing_utm_
                     <ul class="actions-dropdown-list" id="actions-dropdown-list-${dashboard_index}" aria-label="${_('Available Actions')}" role="menu">
                       % if can_unenroll:
                         <li class="actions-item" id="actions-item-unenroll-${dashboard_index}" role="menuitem">
-                          <% course_refund_url = reverse('course_run_refund_status', args=[unicode(course_overview.id)]) %>
+                          <% course_refund_url = reverse('course_run_refund_status', args=[six.text_type(course_overview.id)]) %>
                               % if not is_course_blocked:
                               <a href="#unenroll-modal" class="action action-unenroll" rel="leanModal"
                                  data-course-id="${course_overview.id}"
@@ -426,7 +426,7 @@ from util.course import get_link_for_about_page, get_encoded_course_sharing_utm_
                 % endif
               </div>
               <div class="verification-cta">
-                <a href="${reverse('verify_student_verify_now', kwargs={'course_id': unicode(course_overview.id)})}" class="btn" data-course-id="${course_overview.id}">${_('Verify Now')}</a>
+                <a href="${reverse('verify_student_verify_now', kwargs={'course_id': six.text_type(course_overview.id)})}" class="btn" data-course-id="${course_overview.id}">${_('Verify Now')}</a>
               </div>
             % elif verification_status['status'] == VERIFY_STATUS_SUBMITTED:
               <h4 class="message-title">${_('You have submitted your verification information.')}</h4>
@@ -476,7 +476,7 @@ from util.course import get_link_for_about_page, get_encoded_course_sharing_utm_
                 % if use_ecommerce_payment_flow and course_mode_info['verified_sku']:
                   <a class="action action-upgrade" href="${ecommerce_payment_page}?sku=${course_mode_info['verified_sku']}">
                 % else:
-                  <a class="action action-upgrade" href="${reverse('verify_student_upgrade_and_verify', kwargs={'course_id': unicode(course_overview.id)})}" data-course-id="${course_overview.id}" data-user="${user.username}">
+                  <a class="action action-upgrade" href="${reverse('verify_student_upgrade_and_verify', kwargs={'course_id': six.text_type(course_overview.id)})}" data-course-id="${course_overview.id}" data-user="${user.username}">
                 % endif
                     <span class="action-upgrade-icon" aria-hidden="true"></span>
                   <span class="wrapper-copy">
@@ -492,7 +492,7 @@ from util.course import get_link_for_about_page, get_encoded_course_sharing_utm_
 
         % if course_requirements:
         ## Multiple pre-requisite courses are not supported on frontend that's why we are pulling first element
-        <% prc_target = reverse('about_course', args=[unicode(course_requirements['courses'][0]['key'])]) %>
+        <% prc_target = reverse('about_course', args=[six.text_type(course_requirements['courses'][0]['key'])]) %>
         <div class="prerequisites">
           <p class="tip">
             ${Text(_("You must successfully complete {link_start}{prc_display}{link_end} before you begin this course.")).format(
diff --git a/lms/templates/dashboard/_dashboard_entitlement_actions.html b/lms/templates/dashboard/_dashboard_entitlement_actions.html
index 0c3a61c028..8d97eb7563 100644
--- a/lms/templates/dashboard/_dashboard_entitlement_actions.html
+++ b/lms/templates/dashboard/_dashboard_entitlement_actions.html
@@ -1,6 +1,7 @@
 <%page args="course_overview, entitlement, dashboard_index, can_refund_entitlement, show_email_settings" expression_filter="h"/>
 
 <%!
+import six
 from django.utils.translation import ugettext as _
 from django.urls import reverse
 %>
@@ -38,7 +39,7 @@ dropdown_btn_id = "entitlement-actions-dropdown-btn-{}".format(dashboard_index)
             data-dropdown-button-selector="#${dropdown_btn_id}"
             data-course-name="${course_overview.display_name_with_default}"
             data-course-number="${course_overview.number}"
-            data-entitlement-api-endpoint="${reverse('entitlements_api:v1:enrollments', args=[unicode(entitlement.uuid)]) + '?is_refund=true'}">
+            data-entitlement-api-endpoint="${reverse('entitlements_api:v1:enrollments', args=[six.text_type(entitlement.uuid)]) + '?is_refund=true'}">
             ${_('Unenroll')}
           </a>
         </li>
@@ -53,7 +54,7 @@ dropdown_btn_id = "entitlement-actions-dropdown-btn-{}".format(dashboard_index)
             data-course-id="${course_overview.id}"
             data-course-number="${course_overview.number}"
             data-dashboard-index="${dashboard_index}"
-            data-optout="${unicode(course_overview.id) in course_optouts}">${_('Email Settings')}</a>
+            data-optout="${six.text_type(course_overview.id) in course_optouts}">${_('Email Settings')}</a>
         </li>
       % endif
       </ul>
diff --git a/lms/templates/main.html b/lms/templates/main.html
index 6865060429..f4f732dfa3 100644
--- a/lms/templates/main.html
+++ b/lms/templates/main.html
@@ -14,6 +14,7 @@
 <%namespace name='static' file='static_content.html'/>
 <% online_help_token = self.online_help_token() if hasattr(self, 'online_help_token') else None %>
 <%!
+import six
 from branding import api as branding_api
 from django.urls import reverse
 from django.utils.http import urlquote_plus
@@ -89,7 +90,7 @@ from pipeline_mako import render_require_js_path_overrides
       <%
       rtl_css_file = self.attr.main_css.replace('.css', '-rtl.css')
       %>
-      <link rel="stylesheet" href="${unicode(static.url(rtl_css_file))}" type="text/css" media="all" />
+      <link rel="stylesheet" href="${six.text_type(static.url(rtl_css_file))}" type="text/css" media="all" />
     % else:
       <link rel="stylesheet" href="${static.url(self.attr.main_css)}" type="text/css" media="all" />
     % endif
diff --git a/lms/templates/register-form.html b/lms/templates/register-form.html
index 0a4cb5d5ff..1c09324989 100644
--- a/lms/templates/register-form.html
+++ b/lms/templates/register-form.html
@@ -1,6 +1,7 @@
 <%page expression_filter="h"/>
 <%!
 import third_party_auth
+import six
 from third_party_auth import pipeline, provider
 from django.utils.translation import ugettext as _
 from openedx.core.djangolib.markup import HTML, Text
@@ -169,7 +170,7 @@ from student.models import UserProfile
         <select id="country" name="country" ${'required aria-required="true"' if settings.REGISTRATION_EXTRA_FIELDS['country'] == 'required' else ''}>
           <option value="">--</option>
           %for code, country_name in countries:
-          <option value="${code}">${ unicode(country_name) }</option>
+          <option value="${code}">${ six.text_type(country_name) }</option>
           %endfor
         </select>
       </div>
diff --git a/lms/templates/survey/survey.html b/lms/templates/survey/survey.html
index be9c5a0f81..6cb7e73ed7 100644
--- a/lms/templates/survey/survey.html
+++ b/lms/templates/survey/survey.html
@@ -2,6 +2,7 @@
 <%inherit file="../main.html" />
 <%namespace name='static' file='../static_content.html'/>
 <%!
+import six
 from django.utils.translation import ugettext as _
 from django.urls import reverse
 from django.utils import html
@@ -23,7 +24,7 @@ from openedx.core.djangolib.markup import Text, HTML
       <input type="hidden" name="_redirect_url" value="${redirect_url}" />
 
       % if course:
-        <input type="hidden" name="course_id" value="${unicode(course.id)}" />
+        <input type="hidden" name="course_id" value="${six.text_type(course.id)}" />
 
         <div class="header-survey">
           <h4 class="course-info">
diff --git a/lms/templates/sysadmin_dashboard_gitlogs.html b/lms/templates/sysadmin_dashboard_gitlogs.html
index 849d3be4f2..64d48f6b32 100644
--- a/lms/templates/sysadmin_dashboard_gitlogs.html
+++ b/lms/templates/sysadmin_dashboard_gitlogs.html
@@ -1,6 +1,7 @@
 <%page expression_filter="h"/>
 <%inherit file="/main.html" />
 <%!
+    import six
     from django.urls import reverse
     from django.utils.translation import ugettext as _
     from django.utils.timezone import utc as UTC
@@ -160,7 +161,7 @@ textarea {
                   <tr>
                     <td>${date}</td>
                     <td>
-                      <a href="${reverse('gitlogs_detail', kwargs={'course_id': unicode(cil.course_id)})}">
+                      <a href="${reverse('gitlogs_detail', kwargs={'course_id': six.text_type(cil.course_id)})}">
                         ${cil.course_id}
                       </a>
                     </td>
diff --git a/openedx/features/course_bookmarks/templates/course_bookmarks/course_bookmarks_js.template b/openedx/features/course_bookmarks/templates/course_bookmarks/course_bookmarks_js.template
index 348670d3d0..232ff21a7c 100644
--- a/openedx/features/course_bookmarks/templates/course_bookmarks/course_bookmarks_js.template
+++ b/openedx/features/course_bookmarks/templates/course_bookmarks/course_bookmarks_js.template
@@ -1,6 +1,7 @@
 ## mako
 
 <%!
+import six
 from openedx.core.djangolib.js_utils import dump_js_escaped_json, js_escaped_string
 %>
 
@@ -8,7 +9,7 @@ from openedx.core.djangolib.js_utils import dump_js_escaped_json, js_escaped_str
     require(['course_bookmarks/js/course_bookmarks_factory'], function (CourseBookmarksFactory) {
         CourseBookmarksFactory({
             $el: $(".course-bookmarks"),
-            courseId: '${unicode(course.id) | n, js_escaped_string}',
+            courseId: '${six.text_type(course.id) | n, js_escaped_string}',
             bookmarksApiUrl: '${bookmarks_api_url | n, js_escaped_string}',
         });
     });
diff --git a/themes/edx.org/lms/templates/dashboard.html b/themes/edx.org/lms/templates/dashboard.html
index c582fc49e9..44dcd846d1 100644
--- a/themes/edx.org/lms/templates/dashboard.html
+++ b/themes/edx.org/lms/templates/dashboard.html
@@ -5,6 +5,7 @@
 <%!
 import json
 import pytz
+import six
 from courseware.context_processor import user_timezone_locale_prefs
 from datetime import datetime, timedelta
 from django.utils import timezone
@@ -196,7 +197,7 @@ from student.models import CourseEnrollment
             is_course_blocked = (session_id in block_courses)
             course_verification_status = verification_status_by_course.get(session_id, {})
             course_requirements = courses_requirements_not_met.get(session_id)
-            related_programs = inverted_programs.get(unicode(entitlement.course_uuid if is_unfulfilled_entitlement else session_id))
+            related_programs = inverted_programs.get(six.text_type(entitlement.course_uuid if is_unfulfilled_entitlement else session_id))
             show_consent_link = (session_id in consent_required_courses)
             course_overview = enrollment.course_overview
             resume_button_url = resume_button_urls[dashboard_index]
diff --git a/themes/stanford-style/lms/templates/register-form.html b/themes/stanford-style/lms/templates/register-form.html
index 3bcf7c9992..735f48df38 100644
--- a/themes/stanford-style/lms/templates/register-form.html
+++ b/themes/stanford-style/lms/templates/register-form.html
@@ -1,5 +1,7 @@
+## xss-lint: disable=mako-missing-default
 <%!
 import third_party_auth
+import six
 from third_party_auth import pipeline, provider
 from django.utils.translation import ugettext as _
 from django_countries import countries
@@ -46,6 +48,7 @@ from student.models import UserProfile
 
   <p class="instructions">
     ${_('Create your own {platform_name} account below').format(platform_name=platform_name)}
+    # xss-lint: disable=python-wrap-html
     <span class="note">${_('Required fields are noted by <strong class="indicator">bold text and an asterisk (*)</strong>.')}</span>
   </p>
 
@@ -54,6 +57,7 @@ from student.models import UserProfile
 
   <p class="instructions">
     ## Translators: selected_provider is the name of an external, third-party user authentication service (like Google or LinkedIn).
+    # xss-lint: disable=python-wrap-html, python-interpolate-html
     ${_("You've successfully signed in with {selected_provider}.").format(selected_provider='<strong>%s</strong>' % selected_provider)}<br />
     ${_("We just need a little more information before you start learning with {platform_name}.").format(platform_name=settings.PLATFORM_NAME)}
   </p>
@@ -64,6 +68,7 @@ from student.models import UserProfile
 
 <p class="instructions">
   ${_("Please complete the following fields to register for an account. ")}<br />
+  # xss-lint: disable=python-wrap-html
   ${_('Required fields are noted by <strong class="indicator">bold text and an asterisk (*)</strong>.')}
 </p>
 
@@ -164,7 +169,7 @@ from student.models import UserProfile
         <select id="country" name="country" ${'required aria-required="true"' if settings.REGISTRATION_EXTRA_FIELDS['country'] == 'required' else ''}>
           <option value="">--</option>
           %for code, country_name in countries:
-          <option value="${code}">${ unicode(country_name) }</option>
+          <option value="${code}">${ six.text_type(country_name) }</option>
           %endfor
         </select>
       </div>
@@ -240,7 +245,9 @@ from student.models import UserProfile
       <div class="field required checkbox" id="field-tos">
         <input id="tos-yes" type="checkbox" name="terms_of_service" value="true" required aria-required="true" />
         <label for="tos-yes">${_('I agree to the {link_start}Terms of Service{link_end}').format(
+          # xss-lint: disable=python-wrap-html
           link_start='<a href="{url}" class="new-vp" tabindex="-1">'.format(url=marketing_link('TOS')),
+          # xss-lint: disable=python-wrap-html
           link_end='</a>')}</label>
       </div>
       % endif
@@ -252,7 +259,9 @@ from student.models import UserProfile
           honor_code_path = marketing_link('TOS') + "#honor"
         %>
         <label for="honorcode-yes">${_('I agree to the {link_start}Honor Code{link_end}').format(
+          # xss-lint: disable=python-wrap-html
           link_start='<a href="{url}" class="new-vp" tabindex="-1">'.format(url=honor_code_path),
+          # xss-lint: disable=python-wrap-html
           link_end='</a>')}</label>
       </div>
       % endif