1

I have html data in database tables. It has HTML tags surrounding content. How can render it in a proper HTML format using Golang template?

main.go snippet -

pages_query := fmt.Sprintf("SELECT id, coalesce (accordian_label, '') as accordian_label, coalesce (accordian_contents, '') as accordian_contents, coalesce (user_id, '') as user_id, coalesce (accordian_menu_image_path, '') as accordian_menu_image_path FROM bz_template_accordian_data where user_id = %d", profile.Id) pagesDB, err := db.Query(pages_query)

if err != nil {
    log.Println("Issues with PAGES query")
    panic(err.Error())
}

pages := Pages{
    Id_pages:                  0,
    User_id:                   0,
    Accordian_label:           "",
    Accordian_contents:        "",
    Accordian_menu_image_path: "",
}
resPages := []Pages{}

for pagesDB.Next() {
    var id, user_id int64
    var accordian_label, accordian_contents, accordian_menu_image_path string

    log.Println(slide_query)
    err := pagesDB.Scan(&id, &accordian_label, &accordian_contents, &user_id, &accordian_menu_image_path)

    if err != nil {
        log.Println("db scan issues for pagesDB")
        panic(err.Error())
    }

    pages.Id_pages = id
    pages.Accordian_label = accordian_label
    pages.Accordian_contents = accordian_contents
    pages.User_id = user_id
    pages.Accordian_menu_image_path = accordian_menu_image_path

    resPages = append(resPages, pages)
    // log.Printf(" Showing pages slice %v", resPages)
    log.Println("Pages query executed properly")
    log.Printf("Showing pagesDB - %#v %#v %#v %#v ", accordian_label, accordian_contents, user_id, accordian_menu_image_path)
}

tmpl.ExecuteTemplate(w, "Pages", resPages)
defer db.Close()

pages.html - {{$p := index . 0}}{{$p.Accordian_label}} {{$p := index . 0}}{{$p.Accordian_contents}}

Nitin Nanivadekar
  • 63
  • 4
  • welcome to SO. Please include a complete but minimal version of what you've tried, the intended results, and the desired results. Stack Overflow is not meant to be an impromptu replacement the content you can discover via web searches. – erik258 Sep 17 '22 at 13:26
  • Please provide enough code so others can better understand or reproduce the problem. – Community Sep 17 '22 at 13:30
  • Thanks for your quick response. I've edited the post with code. – Nitin Nanivadekar Sep 17 '22 at 13:55
  • I am guessing that the HTML content is in field pages.Accordian_contents and that field is declared as type string. If so, see [Go template.ExecuteTemplate include html](https://stackoverflow.com/q/41931082/5728991). – Charlie Tumahai Sep 17 '22 at 15:46
  • Thanks @CeriseLimón. Can we somehow have template.HTML in template file? Because the query result has a title field which doesn't have any HTML content. – Nitin Nanivadekar Sep 19 '22 at 05:13
  • Use type template.HTML for fields containing HTML. Use some other type (string for example) for fields that do not contain HTML. It will be helpful if you show the type declaration for Page, and tell us which field has the problem. – Charlie Tumahai Sep 19 '22 at 06:45
  • Thanks Cerise. I'm not able to call type template.HTML from the template. When called in this way - {{$p := index . 0}}{{$p.Accordian_contents HTML}}, the compiler responds with panic: template: Pages.html:14: function "HTML" not defined. IS there any way to convert the tags to HTML before sending them to the template? – Nitin Nanivadekar Sep 19 '22 at 11:03
  • Answer from https://stackoverflow.com/questions/50408505/parsing-html-code-in-page-shown-as-plain-text-with-go-template helped me get the answer, but I'm worried about - Word of warning: this will not protect against code injection! So for example when you substitute %title% and it contains JavaScript code, that will be let through to the output and finally executed in the clients' browsers. Will implement the 'Using the {{template}} action' section in some time. It is safe way to implement. Thanks @CeriseLimón – Nitin Nanivadekar Sep 19 '22 at 11:55
  • Injection attacks are possible when a site displays user generated HTML without escaping. Protect against these attacks by filtering user generated HTML through a list of allowed elements and attributes. – Charlie Tumahai Sep 19 '22 at 14:19

0 Answers0