blocks|key|481679|text|你也可以使用JJIA2的autoescape。因此，例如，您可以在jinja2环境中添加自动转义：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|481680|JINJA_ENVIRONMENT+=+jinja2.Environment(
++++loader=jinja2.FileSystemLoader(os.path.dirname(__file__)),
++++autoescape=True)|code-block|syntax|javascript|481681|或者，您可以使用Jinja2.4中添加的自动转义扩展来更好地控制在HTML中使用自动转义的位置。有关此here和示例(在Google+App+Engine中)+here的更多信息。|481682|Python：|481683|JINJA_ENVIRONMENT+=+jinja2.Environment(
++++loader=jinja2.FileSystemLoader(os.path.dirname(__file__)),
++++extensions=['jinja2.ext.autoescape'])|481684|HTML：|481685|{%25+autoescape+true+%25}
++++<html>
++++++++<body>
++++++++++++{{+IWillBeEscaped+}}
++++++++</body>
++++</html>
{%25+endautoescape+%25}|481686|entityMap|0|LINK|mutability|MUTABLE|url|http://jinja.pocoo.org/docs/api/#autoescaping|1|https://developers.google.com/appengine/docs/python/gettingstartedpython27/templates^0|C|A|0|0|1F|4|0|28|4|1|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@$9|15|A|16|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|17|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|18|8|@]|D|@$9|19|A|1A|1|1B]|$9|1C|A|1D|1|1E]]|E|$]]|$1|M|3|N|5|6|7|1F|8|@]|D|@]|E|$]]|$1|O|3|P|5|H|7|1G|8|@]|D|@]|E|$I|J]]|$1|Q|3|R|5|6|7|1H|8|@]|D|@]|E|$]]|$1|S|3|T|5|H|7|1I|8|@]|D|@]|E|$I|J]]|$1|U|3|-4|5|6|7|1J|8|@]|D|@]|E|$]]]|V|$W|$5|X|Y|Z|E|$10|11]]|12|$5|X|Y|Z|E|$10|13]]]]

You can also use jinja2's <code>autoescape</code>. So, for instance, you could add autoescape to your jinja2 Environment in Python:

<pre><code>JINJA_ENVIRONMENT = jinja2.Environment(
 loader=jinja2.FileSystemLoader(os.path.dirname(__file__)),
 autoescape=True)
</code></pre>

Alternatively, you could use the Autoescape Extension added in Jinja 2.4 to have more control over where the autoescaping is used in the HTML. More information on this <a href="http://jinja.pocoo.org/docs/api/#autoescaping" rel="nofollow">here</a> and example (in Google App Engine) <a href="https://developers.google.com/appengine/docs/python/gettingstartedpython27/templates" rel="nofollow">here</a>.

Python:

<pre><code>JINJA_ENVIRONMENT = jinja2.Environment(
 loader=jinja2.FileSystemLoader(os.path.dirname(__file__)),
 extensions=['jinja2.ext.autoescape'])
</code></pre>

HTML:

<pre><code>{% autoescape true %}
 &lt;html&gt;
 &lt;body&gt;
 {{ IWillBeEscaped }}
 &lt;/body&gt;
 &lt;/html&gt;
{% endautoescape %}
</code></pre>

blocks|key|264786|text|这是一个基于Django的escapejs过滤器，我为在Jinja2模板中使用而编写的：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|264787|_js_escapes+=+{
++++++++'\\':+'\\u005C',
++++++++'\'':+'\\u0027',
++++++++'"':+'\\u0022',
++++++++'>':+'\\u003E',
++++++++'<':+'\\u003C',
++++++++'&':+'\\u0026',
++++++++'=':+'\\u003D',
++++++++'-':+'\\u002D',
++++++++';':+'\\u003B',
++++++++u'\u2028':+'\\u2028',
++++++++u'\u2029':+'\\u2029'
}
#+Escape+every+ASCII+character+with+a+value+less+than+32.
_js_escapes.update(('%25c'+%25+z,+'\\u%2504X'+%25+z)+for+z+in+xrange(32))
def+jinja2_escapejs_filter(value):
++++++++retval+=+[]
++++++++for+letter+in+value:
++++++++++++++++if+_js_escapes.has_key(letter):
++++++++++++++++++++++++retval.append(_js_escapes[letter])
++++++++++++++++else:
++++++++++++++++++++++++retval.append(letter)

++++++++return+jinja2.Markup("".join(retval))
JINJA_ENVIRONMENT.filters['escapejs']+=+jinja2_escapejs_filter|code-block|syntax|javascript|264788|模板中的安全用法示例：|264789|<script+type="text/javascript">

</script>|264790|当variableName为str或unicode时。|264791|entityMap^0|D|8|0|0|0|0|E|3|I|7|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|V|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|W|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|13|8|@]|D|@]|E|$]]]|R|$]]

This is a <code>escapejs</code> filter, based on Django's one, that I wrote for use in Jinja2 templates:

<pre><code>_js_escapes = {
 '\\': '\\u005C',
 '\'': '\\u0027',
 '"': '\\u0022',
 '&gt;': '\\u003E',
 '&lt;': '\\u003C',
 '&amp;': '\\u0026',
 '=': '\\u003D',
 '-': '\\u002D',
 ';': '\\u003B',
 u'\u2028': '\\u2028',
 u'\u2029': '\\u2029'
}
# Escape every ASCII character with a value less than 32.
_js_escapes.update(('%c' % z, '\\u%04X' % z) for z in xrange(32))
def jinja2_escapejs_filter(value):
 retval = []
 for letter in value:
 if _js_escapes.has_key(letter):
 retval.append(_js_escapes[letter])
 else:
 retval.append(letter)

 return jinja2.Markup("".join(retval))
JINJA_ENVIRONMENT.filters['escapejs'] = jinja2_escapejs_filter
</code></pre>

Example safe usage in a template:

<pre><code>&lt;script type="text/javascript"&gt;
&lt;!--
var variableName = "{{ variableName | escapejs }}";
…
//--&gt;
&lt;/script&gt;
</code></pre>

When variableName is a <code>str</code> or <code>unicode</code>.

blocks|key|481769|text|Jinja2有很好的过滤器tojson。如果你从字符串生成json，它会生成用双引号"“括起来的字符串。你可以在javascript中安全地使用它。而且你不需要自己把引号放在周围。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|481770|$("#mydiv").append({{+html_string%7Ctojson+}});|code-block|syntax|javascript|481771|entityMap|0|LINK|mutability|MUTABLE|url|http://jinja.pocoo.org/docs/2.10/templates/#tojson^0|D|6|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

Jinja2 has nice filter <a href="http://jinja.pocoo.org/docs/2.10/templates/#tojson" rel="noreferrer">tojson</a>. If you make json from string, it will generate string enclosed in double quotes "". You can safely use it in javascript. And you don't need put quotes around by yourself.

<pre><code>$("#mydiv").append({{ html_string|tojson }});
</code></pre>

blocks|key|481804|text|基于@tometzky，以下是我的Python+3版本：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|481805|_js_escapes+=+{
++++++++'\\':+'\\u005C',
++++++++'\'':+'\\u0027',
++++++++'"':+'\\u0022',
++++++++'>':+'\\u003E',
++++++++'<':+'\\u003C',
++++++++'&':+'\\u0026',
++++++++'=':+'\\u003D',
++++++++'-':+'\\u002D',
++++++++';':+'\\u003B',
++++++++u'\u2028':+'\\u2028',
++++++++u'\u2029':+'\\u2029'
}
#+Escape+every+ASCII+character+with+a+value+less+than+32.
_js_escapes.update(('%25c'+%25+z,+'\\u%2504X'+%25+z)+for+z+in+range(32))

@register.filter
def+escapejs(value):
++++return+jinja2.Markup("".join(_js_escapes.get(l,+l)+for+l+in+value))|code-block|syntax|javascript|481806|用法完全相同。|481807|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Based on @tometzky here is my Python 3 version:

<pre class="lang-py prettyprint-override"><code>_js_escapes = {
 '\\': '\\u005C',
 '\'': '\\u0027',
 '"': '\\u0022',
 '&gt;': '\\u003E',
 '&lt;': '\\u003C',
 '&amp;': '\\u0026',
 '=': '\\u003D',
 '-': '\\u002D',
 ';': '\\u003B',
 u'\u2028': '\\u2028',
 u'\u2029': '\\u2029'
}
# Escape every ASCII character with a value less than 32.
_js_escapes.update(('%c' % z, '\\u%04X' % z) for z in range(32))

@register.filter
def escapejs(value):
 return jinja2.Markup("".join(_js_escapes.get(l, l) for l in value))
</code></pre>

The usage is exactly the same.

How do I escape HTML with Jinja2 so that it can be used as a string in JavaScript (jQuery)?

If I were using Django's templating system I could write:

<pre><code>$("#mydiv").append("{{ html_string|escapejs }}");
</code></pre>

Django's <a href="https://github.com/django/django/blob/ebc773ada3e4f40cf5084268387b873d7fe22e8b/django/utils/html.py#L63" rel="noreferrer"><code>|escapejs</code> filter</a> would escape things in <code>html_string</code> (eg quotes, special chars) that could break the intended use of this code block, but Jinja2 does not seem to have an equivalent filter (am I wrong here?).

Is there a cleaner solution than copying/pasting the code from Django?

Escape strings for JavaScript using Jinja2?

Django

jQuery

Python

如何使用Jinja2对HTML进行转义，以便在JavaScript (jQuery)中将其用作字符串？如果我使用Django的模板系统，我可以这样写：$("#mydiv").append("{{ html_string|escapejs }}");Django的将避开html_string中可能破坏此代码块预期用途的内...

问使用Jinja2的JavaScript的转义字符串？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Jinja2的JavaScript的转义字符串？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Jinja2的JavaScript的转义字符串？
EN