1

this template variable {{object.video.description}} is outputing this text:

Welcome to <a href="http://google.com">Saint Francis Academy</a> in the heart of Washington.

How can I get the link to show as an actual link instead of being replaced with html entities. I tried filtering it as safe but no luck: {{object.video.description|safe}}

2 Answers 2

3

Can you go to the django shell and see what text is recorded in object.video.description?

How/where does video.description get defined as an html string (what I'm guessing is that a < is already be escaped into &lt; at that point and hence safe won't help). Marking as safe prevents django from converting < to &lt; right before rendering in the template; but won't convert a string containing &lt; into a <.

If the string is originally saved with &lt;s and &gts you can convert them to < and > by a simple python replacement somewhere in your string processing. E.g., in your view do something like:

htmlCodes = (('&', '&amp;'),
             ('<', '&lt;'),
             ('>', '&gt;'),
             ('"', '&quot;'),
             ("'", '&#39;'),)

def unescape(some_html_str):
    for c, html_code in htmlCodes:
        some_html_str = some_html_str.replace(html_code, c)
    return some_html_str

and then remember to unescape your string in your view before putting it in the context (and still remember to mark it safe). See How do I perform HTML decoding/encoding using Python/Django?

Also it may be better/easier for you to use mark_safe (from django.utils.safestring import mark_safe) in your views to make sure only safe strings are marked safe rather than have your template always render something safe.

Sign up to request clarification or add additional context in comments.

Comments

1
{% load markup %}
{{ object.video.description|markdown }}

2 Comments

This assumes that video.description is written in markdown: e.g., a link to wikipedia's markdown pages is [some_text](http://en.wikipedia.org/wiki/Markdown). Now if users are writing text descriptions, its a very good idea to use a markup language docs.djangoproject.com/en/1.3/ref/contrib/markup (rather than letting users write raw html where they could insert javascript for say a CSRF attack or javascript pop-ups or whatever).
sorry, yea my answer should be qualified with that what dr jimbob said!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.