Django: saving data from user input and display

Question

I have a form with a jwysiwyg editor. Looking at it, it can use basic-formatting html tags using the formatting buttons like SO's. Upon submitting the form, I notice its saved into the database as-is, whereas if I enter stuff like <iframe> ... </iframe> into the editor I notice that it is html-encoded inside the table.

Now, when I need to output whatever the user has submitted, can I safely use {{ output|safe }} to display the formatted text?

Is this reasonably secure enough or how should I rectify?

Zach Kelling · Accepted Answer · 2011-05-11 06:04:02Z

3

Use the safe filter only if you html-escape the data first. Otherwise you should use escape. If you want your users to be able to input data with html tags you could try to sanitize the input to prevent users from using <iframe>, <script>, etc, but allow other tags to be white-listed, and then mark it as safe.

edited May 11, 2011 at 6:04

answered May 11, 2011 at 5:55

Zach Kelling

54.1k15 gold badges112 silver badges108 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

goh Over a year ago

assuming that my wysiwyg editor on the client side already handles the unsafe tags before sending to the server, can i safely assume using |safe is alright?

Zach Kelling Over a year ago

If you trust it, then yes. You can also use django.utils.safestring.mark_safe to mark a string as safe.

Collectives™ on Stack Overflow

Django: saving data from user input and display

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related