Sunday, December 9, 2012

Safe escaping for HTML and URL


 >>> link = 'file.py?fname=a&lname=b&amp=c&sect=d&lt=e'  
 # escape for HTML   
 >>> import cgi  
 >>> cgi.escape(link)  
 'file.py?fname=a&jlname=b&amp=c&sect=d&lt=e'  
 # escape for URL   
 >>> import urllib.parse  
 >>> elink = urllib.parse.quote_plus(link)  
 >>> elink  
 'file.py%3Ffname%3Da%26lname%3Db%26amp%3Dc%26sect%3Dd%26lt%3De'  
 # URL satisfies HTML too: same   
 >>> cgi.escape(elink)  
 'file.py%3Ffname%3Da%26lname%3Db%26amp%3Dc%26sect%3Dd%26lt%3De'