Skip to main content

Customizable auto-escaping for jinja2.

Project description

When using Jinja2-templates to output non-HTML contents, autoescaping cannot be used because it is hardcoded to work with an HTML escape function and MarkupSafe’s Markup objects.

jinja_vanish enables implementing custom auto-escapes by overriding the escape function inside the generated template code using an extended code-generator and replacing the built-in filters |e and |escape. Usage is fairly simple, here is an example that uses psycopg2’s mogrify() function to escape SQL for Postgres:

from datetime import datetime

from jinja_vanish import DynAutoEscapeEnvironment, markup_escape_func
from psycopg2.extensions import adapt

@markup_escape_func
def sql_escape(v):
    # the decorator handles wrapping/unwrapping in Markup(), but is
    # otherwise not necessary
    return adapt(v)


env = DynAutoEscapeEnvironment(autoescape=True, escape_func=sql_escape)
tpl = env.from_string('SELECT * FROM foo where post_date <= {{now}}')

print(tpl.render(now=datetime.now()))

Running it outputs:

SELECT * FROM foo where post_date <= '2016-01-24T23:23:22.727789'::timestamp

Project details


Release history Release notifications

History Node

0.2.dev1

This version
History Node

0.1

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
jinja-vanish-0.1.tar.gz (2.5 kB) Copy SHA256 hash SHA256 Source None Jan 24, 2016

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging CloudAMQP CloudAMQP RabbitMQ AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page