Is there a Python equivalent to the PHP function htmlspecialchars()?

Question

Is there a similar or equivalent function in Python to the PHP function htmlspecialchars()? The closest thing I've found so far is htmlentitydefs.entitydefs().

It seems that there is more than one obvious way to do it! O noes! — Grant Paul, Mar 25 '10 at 04:35

score 12 · Answer 1 · answered May 31 '09 at 06:12

12

Closest thing I know about is cgi.escape.

answered May 31 '09 at 06:12

Karl Guertin

4,346
2
22
19

it was deprecated since 3.3 – ncopiy Nov 27 '19 at 13:34

score 7 · Answer 2 · answered Mar 25 '10 at 04:32

7

from django.utils.html import escape
print escape('<div class="q">Q & A</div>')

answered Mar 25 '10 at 04:32

Agonych

330
4
4

1

I'm voting for this because I don't want to parse anything like some of the other answers, or even do a search and replace, I want a single function that does it all for me. – paulmorriss Jun 18 '10 at 15:36

score 5 · Answer 3 · answered Mar 01 '16 at 17:48

5

Building on @garlon4 answer, you can define your own htmlspecialchars(s):

def htmlspecialchars(text):
    return (
        text.replace("&", "&amp;").
        replace('"', "&quot;").
        replace("<", "&lt;").
        replace(">", "&gt;")
    )

answered Mar 01 '16 at 17:48

AlejandroVD

1,576
19
22

I think python has a fancy function named something like "translate" that you could use to make this even shorter – Brian Peterson Feb 07 '20 at 06:25
Too lazy right now but yeah: https://www.programiz.com/python-programming/methods/string/translate – Brian Peterson Feb 07 '20 at 06:27
Helpful answer, however you're passing the parameters to replace() in the wrong order. Should be: replace("string to find", "string to replace") – Ben Apr 25 '21 at 08:06
@Ben no, the function works as expected (it escapes the "html special chars"). It looks for the char to escape, and replaces it by the html escape sequence for that char. Maybe you wanted to un-escape instead? – AlejandroVD Apr 26 '21 at 20:01
My mistake! @AlejandroVD you are spot on. – Ben Aug 15 '21 at 15:31

score 3 · Answer 4 · answered Mar 30 '11 at 15:59

I think the simplest way is just to use replace:

text.replace("&", "&amp;").replace('"', "&quot;").replace("<", "&lt;").replace(">", "&gt;")

PHP only escapes those four entities with htmlspecialchars. Note that if you have ENT_QUOTES set in PHP, you need to replace quotes with ' rather than ".

Nicolas Dumazet · Answer 5 · 2009-05-31T06:56:52.370

3

You probably want xml.sax.saxutils.escape:

from xml.sax.saxutils import escape
escape(unsafe, {'"':'&quot;'}) # ENT_COMPAT
escape(unsafe, {'"':'&quot;', '\'':'&#039;'}) # ENT_QUOTES
escape(unsafe) # ENT_NOQUOTES

Have a look at xml.sax.saxutils.quoteattr, it might be more useful for you

edited May 31 '09 at 06:56

answered May 31 '09 at 06:31

Nicolas Dumazet

7,147
27
36

score 1 · Answer 6 · edited Sep 16 '21 at 06:18

1

Only five characters need to be escaped, so you can use a simple one-line function:

def htmlspecialchars(content):
    return content.replace("&", "&amp;").replace('"', "&quot;").replace("'", "&#039;").replace("<", "&lt;").replace(">", "&gt;")

edited Sep 16 '21 at 06:18

Pikamander2

7,332
3
48
69

answered Jun 11 '21 at 07:03

Devesh Jain

11
2

score 1 · Answer 7 · answered May 31 '09 at 08:27

1

The html.entities module (htmlentitydefs for python 2.x) contains a dictionary codepoint2name which should do what you need.

>>> import html.entities
>>> html.entities.codepoint2name[ord("&")]
'amp'
>>> html.entities.codepoint2name[ord('"')]
'quot'

answered May 31 '09 at 08:27

sykora

96,888
11
64
71

score -1 · Answer 8 · answered May 31 '09 at 06:11

-1

If you are using django 1.0 then your template variables will already be encoded and ready for display. You also use the safe operator {{ var|safe }} if you don't want it globally turned on.

answered May 31 '09 at 06:11

Paul Tarjan

48,968
59
172
213

Is there a Python equivalent to the PHP function htmlspecialchars()?

8 Answers8

Linked