13

I am handling with a Wikipedia-like project. I can convert the text file to html code using the markdown. My problem is, I want to render this html code in a html file. Here is my code,

class articles:
    def GET(self):
        form_name=web.input()
        article_name=form_name.page
        article_file_path=os.path.join('articles',article_name)
        fp = open(article_file_path,'rU')
        text = fp.read()
        body = markdown2.markdown(text)
        return render.article_files(article_name, body)

I'm passing article_name and body(html code) to article_files.html. The body looks like,

<h1>Hai</h1>
<p>Welcome<em>Ajay</em></p>

The problem is, the body displays as it is. That is the html code is printed in the screen with all tags. I want to render this html code (body) like,

Hai
Welcome Ajay

My HTML file is:

$def with(title,content)
<html>
<head>
<title>$title</title>
</head>
<body>
    <form name="form" method="GET">
        $content
    </form>
</body>
</html>
Ajay Soman
  • 1,631
  • 4
  • 19
  • 37

2 Answers2

13

HTML escaping is on by default in web.py templates. To turn it off, prepend the variable name with a colon:

<form name="form" method="GET">
    $:content
</form>

Make sure there is no way for a potentially malicious user to feed arbitrary HTML into your unescaped templates.

Helgi
  • 5,428
  • 1
  • 31
  • 48
2

You need to specify the mime type of the date you are sending to the browser, otherwise it doesn't know how to display it.

You can do this by adding the following line to your function:

web.header('Content-Type', 'text/html')
Andrew Wilkinson
  • 10,682
  • 3
  • 35
  • 38
  • 1
    I'm pretty sure Ajay is talking about the _body_ (i.e., `h1` and `p`) being rendered verbatim, not the whole page. – Helgi Aug 08 '11 at 09:47
  • Not sure why the downvotes. Even if just the body was not being rendered, this is still helpful. Solved my problem, upvoted. – sqram Oct 27 '12 at 19:02