larzhtml

Build HTML in Python - safely. Pure Python, zero dependencies.

Composing HTML with f-strings is how XSS holes get made. larzhtml lets you build markup as nested Python calls where every text child and attribute value is HTML-escaped automatically; you opt out explicitly with raw() for content you already trust.

from larzhtml import div, p, a, ul, li, raw

div(
    p("Hello ", a("world", href="https://x.com")),
    ul(*[li(x) for x in items]),
    class_="card", id="main",
)
# <div class="card" id="main"><p>Hello <a href="https://x.com">world</a></p>...</div>

div("<script>alert(1)</script>")     # -> <div>&lt;script&gt;...&lt;/script&gt;</div>

Why

• Safe by construction. Text and attribute values are escaped by default, so untrusted data can't inject tags or break out of an attribute. The XSS-prone thing (raw(...)) is the one you have to ask for.
• Just Python. Elements are function calls; compose with loops, comprehensions, and conditionals - no template language, no {% %}. Great for emails, snippets, and server-rendered fragments.
• Ergonomic attributes. class_/for_ (trailing underscore), data_toggle -> data-toggle, boolean attrs (disabled=True -> disabled), None/False omitted.
• Zero dependencies. No lxml, no dominate, no markupsafe.

Install

pip install larzhtml

Usage

from larzhtml import div, p, a, img, ul, li, tag, raw, document

div(p("safe ", raw("<b>trusted</b>")), class_="box")
img(src="/logo.png", alt="Logo")                 # void: <img ...>
tag("my-widget")("content", data_id="1")          # any element
document(div("body"), title="Home", lang="en")    # full HTML5 doc

Tests

python -m unittest discover -s tests -v   # 18 tests incl. XSS escaping

The Larz stack

One of 30+ pure-Python, zero-dependency libraries at github.com/larz-scripter - pairs with larzmark and larztemplate.

License

MIT (c) larz-scripter