Django: Allow user to submit valid HTML in form field

Question

With Django, is it possible for users to submit HTML in a form field, save it, and then render the HTML in the template?

An example is a user adding a link within a textfield that should then be rendered as an a tag within the rest of the text.

The user would input something like :

this is a site called <a href="http://stackoverflow.com">SO</a>.

The SO link would be a link instead of rendering it as text.

Answer 1

Django escapes by default. You can mark a string as safe via a filter or tag to prevent the auto escaping behavior.

{{ my_text_with_html|safe }}

{% autoescape off %}
    {{ my_test_with_html }}
{% endautoescape %}

If you accept user inputted html, you'll want to sanitize it so they can't write scripts and such.. for that, just search python html sanitizing and apply it before sending the data to the template.

Python HTML sanitizer / scrubber / filter

Answer 2

You can tell Django the HTML is safe by marking it with the appropriate filter:

{{ variable|safe }}

You can also use the autoescape tag to disable the autoescaping:

{% autoescape off %}
    {{ variable }}
{% endautoescape %}

However, in case you are enabling this feature for other (unknown) users, I highly recommend using something else, since HTML can be quite a pain to properly sanitize from Javascript or other HTML-things you don't want (e.g., on*-arguments etc). Django actually ships with basic support for some markup languages you can provide to your users. I guess markdown is being the most popular.