From 6ca6c36f82b97eafeada61384b2e2f1d0587da86 Mon Sep 17 00:00:00 2001 From: Claude Paroz Date: Thu, 20 Mar 2014 16:50:50 +0100 Subject: Improved strip_tags and clarified documentation The fact that strip_tags cannot guarantee to really strip all non-safe HTML content was not clear enough. Also see: https://www.djangoproject.com/weblog/2014/mar/22/strip-tags-advisory/ --- docs/ref/utils.txt | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'docs/ref/utils.txt') diff --git a/docs/ref/utils.txt b/docs/ref/utils.txt index ea6bffce34..5515c01a20 100644 --- a/docs/ref/utils.txt +++ b/docs/ref/utils.txt @@ -595,17 +595,23 @@ escaping HTML. .. function:: strip_tags(value) - Removes anything that looks like an html tag from the string, that is - anything contained within ``<>``. + Tries to remove anything that looks like an HTML tag from the string, that + is anything contained within ``<>``. + Absolutely NO guaranty is provided about the resulting string being entirely + HTML safe. So NEVER mark safe the result of a ``strip_tag`` call without + escaping it first, for example with :func:`~django.utils.html.escape`. For example:: strip_tags(value) If ``value`` is ``"Joel a slug"`` - the return value will be ``"Joel is a slug"``. Note that ``strip_tags`` - result may still contain unsafe HTML content, so you might use - :func:`~django.utils.html.escape` to make it a safe string. + the return value will be ``"Joel is a slug"``. + + If you are looking for a more robust solution, take a look at the `bleach`_ + Python library. + + .. _bleach: https://pypi.python.org/pypi/bleach .. versionchanged:: 1.6 -- cgit v1.3