python - Django 表单模板转义

Question

{% if form.subject.errors %}
    <ol>
    {% for error in form.subject.errors %}
        <li><strong>{{ error|escape }}</strong></li>
    {% endfor %}
    </ol>
{% endif %}

我从模板中获取了上面的代码，在键'form'下传递了一个表单
但是，我以前从未遇到过|escape 吗？
是 |或按位运算符？

Answer 1

不，这是 |escape template filter [Django-doc] .正如文档所指定的:

Escapes a string’s HTML. Specifically, it makes these replacements:

1. < is converted to <
2. > is converted to >
3. ' (single quote) is converted to '
4. " (double quote) is converted to "
5. & is converted to &

Applying escape to a variable that would normally have auto-escaping applied to the result will only result in one round of escaping being done. So it is safe to use this function even in auto-escaping environments. If you want multiple escaping passes to be applied, use the force_escape filter.

它很可能在 {% autoscape off %}…{% endautoescape %} block [Django-doc] ，因为默认情况下 Django 已经转义了这些项目。因此，它将确保如果变量是包含可以解释为 html 的字符的字符串，则将这些字符转义以防止出现这种情况。