MarkupSafe

https://markupsafe.palletsprojects.com/en/stable/
Admin
MarkupSafe is a Python library that escapes characters to safely display untrusted user input in...
Tokens:1,946
Snippets:24
Trust Score:9.9
Update:6 months ago
Show doc for...
Tokens:
Raw
### Installing MarkupSafe

Source: https://markupsafe.palletsprojects.com/en/stable

Command to install or update the library using pip.

```bash
pip install -U MarkupSafe
```

--------------------------------

### Printf-style Formatting with User Object

Source: https://markupsafe.palletsprojects.com/en/stable/formatting

Shows how to use printf-style formatting with a Markup string and a User object, ensuring proper escaping.

```python
>>> user = User(3, "<script>")
>>> Markup('<a href="/user/%d">%s</a>') % (user.id, user.name)
Markup('<a href="/user/3">&lt;script&gt;</a>')

```

--------------------------------

### Markup Class Usage

Source: https://markupsafe.palletsprojects.com/en/stable/escaping

Demonstrates creating Markup objects, escaping content, and handling objects with an __html__ method.

```python
>>> Markup("Hello, <em>World</em>!")
Markup('Hello, <em>World</em>!')
>>> Markup(42)
Markup('42')
>>> Markup.escape("Hello, <em>World</em>!")
Markup('Hello &lt;em&gt;World&lt;/em&gt;!')
```

```python
>>> class Foo:
...     def __html__(self):
...         return '<a href="/foo">foo</a>'
...
>>> Markup(Foo())
Markup('<a href="/foo">foo</a>')
```

```python
>>> Markup("<em>%s</em>") % ("foo & bar",)
Markup('<em>foo &amp; bar</em>')
>>> Markup("<em>Hello</em> ") + "<foo>"
Markup('<em>Hello</em> &lt;foo&gt;')
```

--------------------------------

### Format User Object with MarkupSafe

Source: https://markupsafe.palletsprojects.com/en/stable/formatting

Demonstrates escaping a User object directly and formatting a string with a User object using the 'link' format specifier.

```python
>>> user = User(3, "<script>")
>>> escape(user)
Markup('<span class="user">&lt;script&gt;</span>')
>>> Markup("<p>User: {user:link}").format(user=user)
Markup('<p>User: <a href="/user/3"><span class="user">&lt;script&gt;</span></a>

```

--------------------------------

### Implement User Class for HTML Formatting

Source: https://markupsafe.palletsprojects.com/en/stable/formatting

Defines a User class with `__html_format__` and `__html__` methods to control how user data is rendered as HTML, including a 'link' format specifier.

```python
class User(object):
    def __init__(self, id, name):
        self.id = id
        self.name = name

    def __html_format__(self, format_spec):
        if format_spec == "link":
            return Markup(
                '<a href="/user/{}">{}</a>'
            ).format(self.id, self.__html__())
        elif format_spec:
            raise ValueError("Invalid format spec")
        return self.__html__()

    def __html__(self):
        return Markup(
            '<span class="user">{0}</span>'
        ).format(self.name)

```

--------------------------------

### Markup conversion of an object with __html__

Source: https://markupsafe.palletsprojects.com/en/stable/html

Demonstrates how the Markup class invokes the __html__ method to generate safe HTML.

```python
>>> img = Image("/static/logo.png")
>>> Markup(img)
Markup('<img src="/static/logo.png">')
```

--------------------------------

### Define an Image class with __html__

Source: https://markupsafe.palletsprojects.com/en/stable/html

Implement the __html__ method to return a custom HTML string representation for an object.

```python
class Image:
    def __init__(self, url):
        self.url = url

    def __html__(self):
        return f'<img src="{self.url}">'
```

--------------------------------

### Escaping text with MarkupSafe

Source: https://markupsafe.palletsprojects.com/en/stable

Demonstrates using the escape function to create a Markup object, which prevents double-escaping and ensures safe concatenation with other strings.

```python
>>> from markupsafe import escape
>>> hello = escape("<em>Hello</em>")
>>> hello
Markup('&lt;em&gt;Hello&lt;/em&gt;')
>>> escape(hello)
Markup('&lt;em&gt;Hello&lt;/em&gt;')
>>> hello + " <strong>World</strong>"
Markup('&lt;em&gt;Hello&lt;/em&gt; &lt;strong&gt;World&lt;/strong&gt;')
```

--------------------------------

### Define a User class with escaped output in __html__

Source: https://markupsafe.palletsprojects.com/en/stable/html

Ensure user-provided data is escaped within the __html__ method to prevent XSS vulnerabilities.

```python
class User:
    def __init__(self, id, name):
        self.id = id
        self.name = name

    def __html__(self):
        return f'<a href="/user/{self.id}">{escape(self.name)}</a>'
```

--------------------------------

### markupsafe.soft_str

Source: https://markupsafe.palletsprojects.com/en/stable/escaping

Converts an object to a string while preserving Markup safety.

```APIDOC
## markupsafe.soft_str(s)

### Description
Convert an object to a string if it isn’t already. This preserves a `Markup` string rather than converting it back to a basic string.

### Parameters
- **s** (Any) - Required - The object to convert.
```

--------------------------------

### markupsafe.Markup

Source: https://markupsafe.palletsprojects.com/en/stable/escaping

A string subclass that is ready to be safely inserted into an HTML or XML document.

```APIDOC
## class markupsafe.Markup(object='', encoding=None, errors='strict')

### Description
A string that is ready to be safely inserted into an HTML or XML document. Passing an object to the constructor wraps it to mark it safe without escaping.

### Methods
- **unescape()**: Convert escaped markup back into a text string.
- **striptags()**: Unescape the markup, remove tags, and normalize whitespace.
- **escape(s)**: Class method to escape a string and return a Markup instance.
```

--------------------------------

### Soft String Conversion

Source: https://markupsafe.palletsprojects.com/en/stable/escaping

Converts objects to strings while preserving the safety status of existing Markup objects.

```python
>>> value = escape("<User 1>")
>>> value
Markup('&lt;User 1&gt;')
>>> escape(str(value))
Markup('&amp;lt;User 1&amp;gt;')
>>> escape(soft_str(value))
Markup('&lt;User 1&gt;')
```

--------------------------------

### Escape Silent Utility

Source: https://markupsafe.palletsprojects.com/en/stable/escaping

Escapes strings while treating None as an empty string instead of the literal 'None'.

```python
>>> escape(None)
Markup('None')
>>> escape_silent(None)
Markup('')
```

--------------------------------

### markupsafe.escape

Source: https://markupsafe.palletsprojects.com/en/stable/escaping

Replaces characters like &, <, >, ', and " in a string with HTML-safe sequences.

```APIDOC
## markupsafe.escape(s)

### Description
Replace the characters `&`, `<`, `>`, `'`, and `"` in the string with HTML-safe sequences. If the object has an `__html__` method, it is called and the return value is assumed to already be safe.

### Parameters
#### Arguments
- **s** (Any) - Required - An object to be converted to a string and escaped.

### Response
- **Markup** - A Markup string with the escaped text.
```

--------------------------------

### Escape a User object

Source: https://markupsafe.palletsprojects.com/en/stable/html

Shows that calling escape() on an object with an __html__ method correctly processes the internal escaped content.

```python
>>> user = User(3, "<script>")
>>> escape(user)
Markup('<a href="/users/3">&lt;script&gt;</a>')
```

--------------------------------

### Markup Unescape and Striptags

Source: https://markupsafe.palletsprojects.com/en/stable/escaping

Methods for reverting escaped entities and removing HTML tags from Markup strings.

```python
>>> Markup("Main &raquo; <em>About</em>").unescape()
'Main » <em>About</em>'
```

```python
>>> Markup("Main &raquo;        <em>About</em>").striptags()
'Main » About'
```

--------------------------------

### markupsafe.escape_silent

Source: https://markupsafe.palletsprojects.com/en/stable/escaping

Escapes a string, treating None as an empty string.

```APIDOC
## markupsafe.escape_silent(s)

### Description
Like `escape()` but treats `None` as the empty string. Useful with optional values.

### Parameters
- **s** (Any | None) - Required - The object to escape.
```
Tokens:
Raw