One of your user lookups is returning an encoded bytestring rather than a Unicode object.
When Python 2.x is asked to concatenate Unicode and encoded bytestrings, it does so by decoding the bytestring into Unicode using the default encoding, which is ascii unless you go to some effort to change it. The # -*- coding: utf-8 -*- directive sets the encoding for your source code, but not the system default encoding.
From testing format, it looks like it tries to convert the argument to match the type of the left-hand side.
Under 2.x, things will work fine as long as the bytestring you're using can be decoded using ascii:
>>> u'test\u270c {0}'.format('bar')
u'test\u270c bar'
Or of course you're formatting in another Unicode object:
>>> u'test\u270c {0}'.format(u'bar\u270d')
u'test\u270c bar\u270d'
If you omit the u before your format, you'll get a UnicodeEncodeError:
>>> 'foo {0}'.format(u'test\u270c')
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
UnicodeEncodeError: 'ascii' codec can't encode character u'\u270c' in position 4: ordinal not in range(128)
Conversely, if you format an encoded string with non-ascii bytes into a Unicode object, you'll get a UnicodeDecodeError:
>>> u'foo {0}'.format(test.encode('utf-8'))
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
UnicodeDecodeError: 'ascii' codec can't decode byte 0xe2 in position 4: ordinal not in range(128)
I'd start by checking the get_absolute_url implementation. Valid URLs can never contain unescaped non-ascii characters, so they should always be decodable by ascii, but if you're using things built from standard Django models first_name and last_name should be Unicode objects so I'd bet on a buggy implementation of get_absolute_url at first.
strbeing passed tounicode.format(), you also appear to be injecting raw strings into HTML markup, which likely represents a XSS security hole. When you create HTML from plain text variables you need to HTML-escape them before adding them to the markup string, for example usingdjango.utils.html.escape.