search

pelme / htpy

Generate HTML in Python
http://htpy.dev
MIT License
261 stars 11 forks source link

An exported "safe" element #16

Closed Rhys-R closed 7 months ago

Rhys-R commented 7 months ago

Hello! I was using htpy with flask and noticed that strings included in an htpy element are auto-escaped by default. This is obviously fine and good, but when trying to insert something like a hardcoded query-string or a script tag that uses &, I noticed that they get escaped as well. I found a workaround by looking at how markupsafe works (wrapping the script or url in a class that provides an __html__ attr), but it required a bit of digging.

Would it be out of scope to provide an exported safe "pseudo-tag", which just escapes the auto-escaping?

pelme commented 7 months ago

Does wrapping your markup in markupsafe.Markup work for you?

https://htpy.dev/usage/#injecting-markup

Rhys-R commented 7 months ago

Urgh... looks like I was digging in the wrong spot. Sorry for not RTFMing hard enough! Thank you for your work on the library!