Comments on: Escaping autoescape in Django

By: Benjamin Sergeant

Benjamin Sergeant — Thu, 19 Mar 2009 01:04:03 +0000

I had the same problem when trying to render highlighted code from pygments. Thanks for the tips ! (I used Peter Reeves per view trick with RequestContext).

By: Peter Reeves

Peter Reeves — Mon, 25 Feb 2008 01:13:34 +0000

For a single template you can also disable the autoescape in the contextinstance. I have this at the end of my function:

context_instance=RequestContext(request)
context_instance.autoescape=False
return render_to_response('my_template.html', {'mydata':mydata,}, context_instance)

This was because ampersands were being escaped in my template as & - My template needed the ampersands intact as it fed a .swf file with the data.

By: dibau naum h

dibau naum h — Fri, 15 Feb 2008 12:02:15 +0000

Thanks for posting! Works like charm.

By: Eddie Sullivan

Eddie Sullivan — Tue, 29 Jan 2008 01:37:51 +0000

Thanks for the tip. That would indeed simplify things. I may even post it to this weblog when I do it.

By: Simon Willison

Simon Willison — Tue, 29 Jan 2008 01:22:26 +0000

If you're outputting a large amount of JSON, have you considered using a custom template tag to do so? You could write one that passes a variable through simplejson and marks it as safe at the same time (using django.utils.safestring.mark_safe() )

By: Eddie Sullivan

Eddie Sullivan — Tue, 29 Jan 2008 00:09:26 +0000

I'll look into posting one of the templates (they're for unpublished sites at the moment), but what's happening is a quantity of data is being passed in JSON form to some Javascript code. This of course relies on quotation marks and some other "unsafe" characters. Now, in future templates, and eventually in my legacy templates, I will take the autoescaping behavior into account and leave it on except when I need it off. However, for now I need existing things to work so I can proceed with development.

By: Simon Willison

Simon Willison — Mon, 28 Jan 2008 23:11:21 +0000

Is there any chance you could post one of your templates to dpaste.com ? I haven't heard many reports of people having templates that were severely affected by auto-escaping - I'd love to see what's causing your problem, as we may be able to offer a better solution. We won't be adding a setting to settings.py though, as it will lead to the exact same problems that plagued PHP's magic quotes - people won't be able to write re-usable Django code because they won't be able to rely on auto-escaping being turned on or off.