[Fixed]-In Django, How do I get escaped html in HttpResponse?

by

37👍

Lakshman Prasad‘s answer is technically correct, but a bit cumbersome. A better way to escape text would be (as suggested in a comment by miku above):

from django.utils.html import escape
return HttpResponse(escape(some_string))
👤Joel Cross

6👍

To return just plain HTML to the client from within your view, use django.http.HttpResponse

from django.http import HttpResponse

def view(request)
    # Do stuff here
    output = '''
    <html>
        <head>
            <title>Hey mum!</title>
        </head>
    </html>'''
    return HttpResponse(output)

To prevent the Django templating system from escaping HTML in a template, just use the |safe filter:

response = "<img src='cats.png'/>"

# Meanwhile, in the template...
<div id="response">
    {{response|safe}}
</div>
👤Josh Hunt

1👍

It should escape by default.

But, if you want to, you can explicitly force escaping.

from django.utils.safestring import mark_for_escaping
return HttpResponse(mark_for_escaping(loader.render_to_string(""""Render Response Syntax"""))
👤lprsd

0👍

For escaping html you can use escape module.

And also you can override this behavior of HttpResponse by:


from django.utils.html import escape
from django.http import HttpResponse

class HttpResponseEscaped(HttpResponse):
    def __init__(self, content, *args, **kwargs):
        super().__init__(escape(content), *args, **kwargs)
👤Omid Raha

0👍

In Django, auto-escaping is off by default

👤rifat1747

Leave a comment