Geek Answers Handbook

How can I insert the actual html from the model into the template?

In my admin area, I have a text area where the user can enter html:

<ul>
  <li>blah</li>
</ul>
<p>
  Stuffs
</p>

When I click above on my template and I look at the source of the page, I get:

&lt;ul&gt;
  &lt;li&gt;blah&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;
  Stuffs
&lt;/p&gt;

What should I do with my result so that I see the actual html in the page source?

+5
source share
3 answers

you need a "safe" filter. Because it is auto-protected.

{{ my_html|safe }}
+6
source

See template tag documentation here , check tag description autoescape.

0
source

" " <textarea>?

Because, if so, escaping <before &lt;(and others) is what you should do inside a text box or any other HTML element: Django does the right thing. You see the correct, decrypted version of the text on the page; who cares what the source looks like?

If you do not avoid the contents of the text field, you not only generate invalid HTML, but also open yourself up for attacks when the user types:

</textarea>
<script>
    steal(document.cookie);
    location.href= 'russian malware site';
    // etc.
</script>
0
source

More articles:


All Articles