My Django/Python Code is Not Rendering HTML <a> Tag in HTML Page

Question

I want something similar to Twitter mentions that are turned into links but it is not working. If we assume we have message = 'Do not forget to come with the Python book, @friend'

#function to convert @mentions to links
def mentions(message, username):
    this_user_handle = reverse('mysite:profile', args=[username])
    new_message = re.sub(r'(@\w+)', r"<a href= '#'>\g<0></a>", message)
    new_message.replace('#', this_user_handle)
    return new_message

mentions(message, 'yax') returns Do not forget to come with the Python book, <a href= '#'>@friend</a>'. The # is not replaced and the new_message still displays as is in HTML page:

<p class= 'Post'>
    {{ new_message|linebreaksbr}}
</p>

This displays this:

Do not forget to come with the Python book, <a href= '#'>@friend</a>'

Instead of:

Do not forget to come with the Python book, @friend

How do I get around this? Thank you in advance!

Try safe

Celeo
– Celeo

2014-10-21 15:29:57 +00:00
Commented Oct 21, 2014 at 15:29 — Celeo
– Celeo, Commented Oct 21, 2014 at 15:29

kviktor · Accepted Answer · 2014-10-21 16:00:34Z

2

Replace returns a new string.

new_message = new_message.replace("#", "...")

Also Django automatically escapes HTML in templates, to disable it use the safe filter.

edited Oct 21, 2014 at 16:00

answered Oct 21, 2014 at 15:42

kviktor

1,0981 gold badge12 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Daniel Roseman · Accepted Answer · 2014-10-21 15:50:30Z

1

The content is being automatically escaped to prevent things like script injection. Use the |safe filter is you're certain that it can't contain anything nasty.

answered Oct 21, 2014 at 15:50

Daniel Roseman

602k68 gold badges910 silver badges923 bronze badges

2 Comments

Yax Over a year ago

Anything nasty? Can you enlighten me more on that? Links can do.

kviktor Over a year ago

User handler or message containing <script>alert("I'm nasty");</script> for example.

cdvv7788 · Accepted Answer · 2014-10-21 15:41:47Z

0

Use kwargs instead of args:

reverse('profile', kwargs={'user_name': username})

You should replace the href='' by href="" to avoid mixing things you don't want to mix (you would need to replace that in several places tho).

answered Oct 21, 2014 at 15:41

cdvv7788

2,0971 gold badge19 silver badges26 bronze badges

Collectives™ on Stack Overflow

My Django/Python Code is Not Rendering HTML <a> Tag in HTML Page

3 Answers 3

Comments

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related