use Jinja's tojson filter

This commit is contained in:
David Lord 2021-02-01 22:41:49 -08:00
parent fdf5d11b51
commit b473e7c97c
No known key found for this signature in database
GPG key ID: 7A1C87E3F5BC42A8
7 changed files with 28 additions and 88 deletions

View file

@ -250,14 +250,15 @@ for easier customization. By default it handles some extra data types:
- :class:`~markupsafe.Markup` (or any object with a ``__html__``
method) will call the ``__html__`` method to get a string.
:func:`~htmlsafe_dumps` is also available as the ``|tojson`` template
filter. The filter marks the output with ``|safe`` so it can be used
inside ``script`` tags.
Jinja's ``|tojson`` filter is configured to use Flask's :func:`dumps`
function. The filter marks the output with ``|safe`` automatically. Use
the filter to render data inside ``<script>`` tags.
.. sourcecode:: html+jinja
<script type=text/javascript>
renderChart({{ axis_data|tojson }});
const names = {{ names|tosjon }};
renderChart(names, {{ axis_data|tojson }});
</script>
.. autofunction:: jsonify

View file

@ -60,27 +60,9 @@ like this:
.. sourcecode:: html+jinja
<script type=text/javascript>
$SCRIPT_ROOT = {{ request.script_root|tojson|safe }};
$SCRIPT_ROOT = {{ request.script_root|tojson }};
</script>
The ``|safe`` is necessary in Flask before 0.10 so that Jinja does not
escape the JSON encoded string with HTML rules. Usually this would be
necessary, but we are inside a ``script`` block here where different rules
apply.
.. admonition:: Information for Pros
In HTML the ``script`` tag is declared ``CDATA`` which means that entities
will not be parsed. Everything until ``</script>`` is handled as script.
This also means that there must never be any ``</`` between the script
tags. ``|tojson`` is kind enough to do the right thing here and
escape slashes for you (``{{ "</script>"|tojson|safe }}`` is rendered as
``"<\/script>"``).
In Flask 0.10 it goes a step further and escapes all HTML tags with
unicode escapes. This makes it possible for Flask to automatically
mark the result as HTML safe.
JSON View Functions
-------------------

View file

@ -95,37 +95,6 @@ by default:
{% from '_helpers.html' import my_macro with context %}
Standard Filters
----------------
Flask provides the following Jinja2 filters in addition to the filters provided
by Jinja2 itself:
.. function:: tojson
:noindex:
This function converts the given object into JSON representation. This
is for example very helpful if you try to generate JavaScript on the
fly.
.. sourcecode:: html+jinja
<script type=text/javascript>
doSomethingWith({{ user.username|tojson }});
</script>
It is also safe to use the output of `|tojson` in a *single-quoted* HTML
attribute:
.. sourcecode:: html+jinja
<button onclick='doSomethingWith({{ user.username|tojson }})'>
Click me
</button>
Note that in versions of Flask prior to 0.10, if using the output of
``|tojson`` inside ``script``, make sure to disable escaping with ``|safe``.
In Flask 0.10 and above, this happens automatically.
Controlling Autoescaping
------------------------