How to get html passed as a variable from python flask into html?

Question

In this example:

from flask import Flask, render_template, redirect, session
app = Flask(__name__)
app.secret_key="secret"

@app.route('/')
def landing():
    session['results']="<p>Test one</p>"
    session['results']+="<p>Test two</p>"
    results=session['results']
    return render_template('index.html', results=results)

app.run(debug='True')

In my html, I have something like this:

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8">
        <title>Game</title>
    </head>
    <body>
    {{ results }}

    </body>
</html>

The results are an html page that does not interpret the

tags. So, I get a page that looks like this:

<p>Test One</p><p>Test Two</p>

What you are doing is hard, because it really isn't something you should be doing. It has the potential to introduce security problems in your application, for example if 'session['results'] contained '<script src="hacksRus.example.com/badstuff.js" type="text/javascript" /><p>Not up to mischief, honest.</p>'. A better approach would be to keep the HTML in the template file: iterate over the items in results, and wrap them in 'p' tags in the template. — corriganjc
– corriganjc, Commented Feb 16, 2017 at 11:16
Thanks for that. Makes perfect sense. In this instance, the code on the backend is the only code that updates that dictionary. It isn't user controlled. But I will see about using your method. I am super new to python, and flask. I could do this easily in javascript ;) — Ryan Turner
– Ryan Turner, Commented Feb 16, 2017 at 11:22
BTW... Would you mind sharing how you would structure the process you are describing? — Ryan Turner
– Ryan Turner, Commented Feb 16, 2017 at 11:23
{% for result in results %} <p>{{ result }}</p> {% endfor %} instead of just {{ results }}. The templating language is Jinja, AFAIK, and you can read about that here: jinja.pocoo.org — corriganjc
– corriganjc, Commented Feb 16, 2017 at 11:55

Matt · Accepted Answer · 2018-08-07 22:51:28Z

5

You could escape the HTML:

{{ results|safe}}

or in Python

import jinja2
results = jinja2.escape(results)

edited Aug 7, 2018 at 22:51

Matt

5198 silver badges19 bronze badges

answered Feb 16, 2017 at 11:06

Mithilesh Gupta

2,9401 gold badge21 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

corriganjc · Accepted Answer · 2017-02-16 13:11:17Z

0

The framework is escaping the HTML in the results variable to prevent security holes. Ideally you want to keep the HTML in the template and not be passed in via the variables. The best way to achieve what you want is to iterate over the values in results variable and wrap it in p tags in the template. This can be done like this:

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8">
        <title>Game</title>
    </head>
    <body>
    {% for result in results %}
        <p>{{ result }}</p>
    {% endfor %}
    </body>
</html>

The templating language is Jinja2, and you can read about that here: http://jinja.pocoo.org/

edited Feb 16, 2017 at 13:11

answered Feb 16, 2017 at 13:04

corriganjc

7007 silver badges21 bronze badges

Comments

stevemclaugh · Accepted Answer · 2017-06-16 15:56:38Z

0

Try this:

from flask import Markup
results = Markup(results)

answered Jun 16, 2017 at 15:56

stevemclaugh

1

1 Comment

ohmu Over a year ago

While this code may answer the question, providing additional context regarding how and why it solves the problem will improve the answer's long-term value.

Collectives™ on Stack Overflow

How to get html passed as a variable from python flask into html?

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related