Skip to main content

Customizable auto-escaping for jinja2.

Project description

When using Jinja2-templates to output non-HTML contents, autoescaping cannot be used because it is hardcoded to work with an HTML escape function and MarkupSafe’s Markup objects.

jinja_vanish enables implementing custom auto-escapes by overriding the escape function inside the generated template code using an extended code-generator and replacing the built-in filters |e and |escape. Usage is fairly simple, here is an example that uses psycopg2’s mogrify() function to escape SQL for Postgres:

from datetime import datetime

from jinja_vanish import DynAutoEscapeEnvironment, markup_escape_func
from psycopg2.extensions import adapt

def sql_escape(v):
    # the decorator handles wrapping/unwrapping in Markup(), but is
    # otherwise not necessary
    return adapt(v)

env = DynAutoEscapeEnvironment(autoescape=True, escape_func=sql_escape)
tpl = env.from_string('SELECT * FROM foo where post_date <= {{now}}')


Running it outputs:

SELECT * FROM foo where post_date <= '2016-01-24T23:23:22.727789'::timestamp

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for jinja-vanish, version 0.1
Filename, size File type Python version Upload date Hashes
Filename, size jinja-vanish-0.1.tar.gz (2.5 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page