Tuesday, October 2, 2012

Autoescape of & char ignoring safe filter

Hi, i'm trying to output raw html content form the database on the website, so i use the safe filter on the variable. All html code is displayed correctly except the ampersand that are escaped ignoring the safe filter, or It seems to me.

I also tried to use a templatetag  with the mark_safe function with the same outcome.

Here an example:

Source in database:    <object width="560" height="340"><param name="movie" value="http://www.youtube.com/v/Uq8zzBW9hlc&hl=en&fs=1&hd=1"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/Uq8zzBW9hlc&hl=en&fs=1&hd=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="560" height="340"></embed></object>    On template with |safe filter (notice "&" replacement with "&amp;"):    <object height="340" width="560"><param name="movie" value="http://www.youtube.com/v/Uq8zzBW9hlc&amp;hl=en&amp;fs=1&amp;hd=1"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed src="http://www.youtube.com/v/Uq8zzBW9hlc&amp;hl=en&amp;fs=1&amp;hd=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" height="340" width="560"></object>

You know what can be the reason to this behaviour and how to solve it?

Thank you,
Marc Serra

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To view this discussion on the web visit https://groups.google.com/d/msg/django-users/-/M3FV3yY7JnoJ.
To post to this group, send email to django-users@googlegroups.com.
To unsubscribe from this group, send email to django-users+unsubscribe@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/django-users?hl=en.

0 Comments:

Post a Comment

Subscribe to Post Comments [Atom]

<< Home


Real Estate