Django not rendering html with tags assigned in python code

Question

I want to display the chemical formula of compound with subscript. I have a list of compounds and few of them should be written using subscript. I wrote the following code:

def contains_number(string):
    new_string = ''
    int_str_list = list(map(str, list(range(9))))
    for item in string:
        if item in int_str_list:
            new_string += '<sub> '+item+' </sub>'
        else:
            new_string += item
    return new_string

This code works and when I pass string like Fe2O3, I get the output like: Fe2O3 which is what I want.

However, when I pass this as a context variable to Django template, it is not rendered as Fe₂O₃ but as text Fe2O3 .

Since I am new to Django, I am missing something, I know.

How can I fix this?

Those two outputs look the same to me, whats different? What code are you using to pass as context? — Sayse
– Sayse, Commented Dec 3, 2015 at 13:18
That was my thought exactly. It is rendered in browser, however as, Fe2O3 ., which if put into plain html will give the subscripted text. — Jack_of_All_Trades
– Jack_of_All_Trades, Commented Dec 3, 2015 at 13:20
You should probably turn escape off in django template: docs.djangoproject.com/en/1.8/ref/templates/builtins/… — stellasia
– stellasia, Commented Dec 3, 2015 at 13:22
@stellasia : Wonderful, that was the culprit. Thank you very much. Please post it as your answer so that I can accept it. — Jack_of_All_Trades
– Jack_of_All_Trades, Commented Dec 3, 2015 at 13:27
if the item is user input, you should escape it first, then you can disable autoescape. — HassenPy
– HassenPy, Commented Dec 3, 2015 at 13:31

Daniel Hepper · Accepted Answer · 2015-12-03 13:38:30Z

Django autoescapes template variables. If you look at the source of the generated output, you will see something like 2....

Do not just turn autoescaping if the parameter string is user generated input!

Auto-escaping prevents XSS attacks, so turning it off might fix your problem, but can lead to a security vulnerability if you don't know exactly what you are doing.

from django.utils.html import escape
from django.utils.safestring import mark_safe


def contains_number(string):
    new_string = ''
    for item in string:
        if item.isdigit():
            # we know item is a number, so no need to escape it
            new_string += '<sub> '+ item +' </sub>'  
        else:
            new_string += escape(item)
    # we built new_string from safe parts, so we can mark it as
    # safe to prevent autoescaping
    return mark_safe(new_string)

Ihor Pomaranskyy · Accepted Answer · 2015-12-03 13:38:56Z

2

... or you can use safe filter:

{{ your_text|safe }}

I believe in most cases it's safer than autoescape blocks (no risk you'll leave unescaped something you have to escape).

answered Dec 3, 2015 at 13:38

Ihor Pomaranskyy

5,6691 gold badge36 silver badges41 bronze badges

Comments

Jack_of_All_Trades · Accepted Answer · 2015-12-03 13:35:23Z

1

Your problem is related to HTML tag escape. Turn the autoescape off in the django templates and it should work fine:

{% autoescape off %}
    {{ you_text }}
{% endautoescape %}

edited Dec 3, 2015 at 13:35

Jack_of_All_Trades

11.6k20 gold badges64 silver badges96 bronze badges

answered Dec 3, 2015 at 13:29

stellasia

5,6624 gold badges27 silver badges45 bronze badges

Collectives™ on Stack Overflow

Django not rendering html with tags assigned in python code

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related