Python/Django: How to render user-submitted videos code fragments as embedded videos?

Question

I want to enable users to submit video links in a post/comment and render it as embedded videos.

For example, youtube supplies code for embedding videos, something like:

<iframe width="420" height="345" src="http://www.youtube.com/embed/Rr6PWlOgPrs" frameborder="0" allowfullscreen></iframe>

If a user puts the above code fragment in a comment, how do I render it correctly?

Django auto-escapes all HTML tags, so by default the above code wouldn't work. But if I disable auto-escaping then I'd open a ton of security risks.

What's the best way of handling this?

Answer 1

The user should never be able to insert HTML directly. Look into django-oembed. This way the user will only have to paste in the URL and oembed will match it and switch the matched urls automatically with object embed code.