Escape characters and raw string

Question

I wanto to replase ">" with ">". And the same for other symbols.

def escape_html(s):
    s = s.replace(">", r">")
    s = s.replace("<", "&lt;")
    s = s.replace('"', "&quot;")
    s = s.replace('&', "&amp;")
    return s

print escape_html(">")

The result is >

But I need >

Could you help me understand why raw string doesn't help me. And how should I write the code?

Answer 1

You need to replace & first:

def escape_html(s):
    s = s.replace('&', "&")
    s = s.replace(">", ">")
    s = s.replace("<", "&lt;")
    s = s.replace('"', "&quot;")
    return s

because otherwise you are replacing the & in each of the other replacements you made. This has nothing to do with Python raw string literals; that only disables \-style escapes.

You could also just use the cgi.escape() function; set the second argument to True to have it escape quotes.

Demo:

>>> def escape_html(s):
...     s = s.replace('&', "&")
...     s = s.replace(">", ">")
...     s = s.replace("<", "&lt;")
...     s = s.replace('"', "&quot;")
...     return s
... 
>>> escape_html('<script>alert("Oops & bummer!")</script>')
'&lt;script&gt;alert(&quot;Oops &amp; bummer!&quot;)&lt;/script&gt;'
>>> import cgi
>>> cgi.escape('<script>alert("Oops & bummer!")</script>', True)
'&lt;script&gt;alert(&quot;Oops &amp; bummer!&quot;)&lt;/script&gt;'