CODEWITHSUNDEEP
djangodjango-templates
Thierry Lam
Thierry Lam

Reputation: 46284

How do I inject actual html from the model to the template?

In my admin, I have a text area where the user can input html:

<ul>
  <li>blah</li>
</ul>
<p>
  Stuffs
</p>

When I push the above to my template and I view the source of the page, I get:

&lt;ul&gt;
  &lt;li&gt;blah&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;
  Stuffs
&lt;/p&gt;

What should I do with my output so that I see actual html in the page source?

Upvotes: 6

Views: 2620

Answers (3)

bobince
bobince

Reputation: 536587

By “text area”, do you mean a <textarea>?

Because if so, escaping < to &lt; (et al) is what you must do inside a textarea or any other HTML element: Django is doing the Right Thing. You see the correct, decoded version of the text on the page; who cares what the source looks like?

If you don't escape the contents of a textarea you are not only generating invalid HTML, you're also opening yourself to attacks where the user inputs:

</textarea>
<script>
    steal(document.cookie);
    location.href= 'russian malware site';
    // etc.
</script>

Upvotes: 0

kender
kender

Reputation: 87211

See the template tags documentation here, check the autoescape tag description.

Upvotes: 0

Nixarn
Nixarn

Reputation: 1546

you need the 'safe' filter. As it's autoescaped.

{{ my_html|safe }}

Upvotes: 8

Related Questions