14

What I want is like stack overflow. User can HTML format their text input, and the page should be rendered exactly in the same way,

I use the wmd.js to store the formatted input, Consider I have a context variable {{variable}} with string value "<p>something</p>". When I render the template,

{{variable}} outputs <p>something</p>

and {{variable|safe}} also output <p>something</p>

It shows the html tag as text in the page. How to render the HTML tag in the {{variable}} but not showing them as plain text.

the template

    <div id='thread_answer_content' >
        {% for answer in question.answer_set.all %}
            {{answer.answerbody|safe}}
        {% endfor %}
    </div>

the view

def detail(request,question_id):
q = get_object_or_404(Question,pk=question_id)
return render_to_response('CODE/detail.html',{'question':q},
        context_instance = RequestContext(request)
    )

here is the django admin page of the question , am using sqlite3 by the way enter image description here

4
  • What is that something? Is it a context variable? Commented Dec 26, 2012 at 6:59
  • If you view the source of the rendered page, do you see &lt;p%gt;something&lt;/&gt; or <p>something</p>? Commented Dec 27, 2012 at 4:31
  • the source shows <p>something</p> Commented Dec 27, 2012 at 4:57
  • What does answer.answerbody contains exactly in the database? It might be double-double quoted or can contain escape characters added by the wmd.js before sending to server for security. And in that way, it could break the safe filter. Commented Dec 27, 2012 at 5:40

4 Answers 4

27
+50

use tag : http://docs.djangoproject.com/en/dev/ref/templates/builtins/#autoescape

{% autoescape off %}{{ variable }}{% endautoescape %} 
Sign up to request clarification or add additional context in comments.

Comments

2

You may want to use escape to render it, instead of safe.

{{ variable|escape }}

1 Comment

@rohan - He actually wanted it to be paragraphed rather than escape.
2

For simple HTML formatting, use <p>{{something}}</p>. And the Javascript way is,

<script type="text/javascript">
    var variable  =  "<p>{{something}}</p>";
    document.write(variable);
</script>

If that {{something}} itself contains the HTML tags, then {{something|safe}} itself should work unless you have {% autoescape on %}. For more filtering and formatting refer Built-in template tags and filters.

5 Comments

ok suppose a user input like this "<p>hello world</p>",and i actually save the input like "<p>hello world</p>", now i want to render the template with the input,so i did this variable = "<p>hello world</p>",{{variable}}; now the output will be <p>hello world</p>,but i don't want the <p> tag shows up like a text,i need it to be rendered as html tag,that means the output should be "hello world" in a html paragraph tag.
the reason am doing this is because in this way user can formatting their input, so the output will be exactly the same way, just like stack overflow, when u post a question, u format ur input,and it will be published in the same format.
so you want a client side preview right? Then you shouldn't have mixed the {{}} in your question which refers the context variables served from response.
no i get the preview, i used wmd.js , but after user post their question,how to render the server response in the same way???
Then the {{variable|safe}} should work. You better post your exact code. Have you set {% autoescape on %}?
0

I think another approach for this is to use the firstof tag:

Note that the variables included in the firstof tag will not be escaped. This is because template tags do not escape their content. Any HTML or Javascript code contained in the printed variable will be rendered as-is, which could potentially lead to security issues. If you need to escape the variables in the firstof tag, you must do so explicitly

{% firstof variable %}

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.