Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Django: Why is this output HTML-escaped

In my template I'm writing:

<div class="content video">{{ each.text }}</div>

And I'm getting:

<iframe width="300" height="200" src="http://www.youtube.com/embed/1C1HLH-hOZU" frameborder="0" webkitAllowFullScreen mozallowfullscreen allowfullscreen></iframe>

I want that text to be the part of the mark up,not as text.What say?

like image 520
Rajat Saxena Avatar asked Aug 04 '12 17:08

Rajat Saxena


People also ask

How do you turn off Django automatic HTML escaping?

The autoescape tag takes one argument, which must be either “on” or “off”: on (the default) – The HTML in all variables will be escaped using HTML entities. off – The HTML will not be escaped.

Does Django escape HTML?

Django Templates are safe-by-default, which means that expressions are HTML-escaped by default.

What is escaping in Django?

Escaping is turning non-safe characters - like HTML tags - into escaped versions so that malicious content such as script tags don't ruin your site. Django does this by default on all content rendered in a template from a variable.

What does {% %} mean in Django?

This tag can be used in two ways: {% extends "base.html" %} (with quotes) uses the literal value "base.html" as the name of the parent template to extend. {% extends variable %} uses the value of variable . If the variable evaluates to a string, Django will use that string as the name of the parent template.


1 Answers

Do you mean the output of each.text is escaped and you see the text in your browser rather than the rendered markup?

This is because Django's template engine autoescapes output by default for security reasons. You might want to use the builtin safe filter like this:

<div class="content video">{{ each.text|safe }}</div>

Or another way is to use mark_safe in your view.

like image 174
Dirk Eschler Avatar answered Oct 19 '22 06:10

Dirk Eschler