Ticket #2862: better_escape.patch

django/utils/html.py

@@ -22 +22 @@
 del x # Temporary variable
 
 def escape(html):
-    "Returns the given HTML with ampersands, quotes and carets encoded"
-    if not isinstance(html, basestring):
-        html = str(html)
-    return html.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;').replace('"', '&quot;').replace("'", '&#39;')
+    """
+    HTML escape the given text with ampersands, quotes and carets encoded.
+    Alternately, if a list is given, a copy of the list is returned with each
+    item html escaped (recursively if necessary).
+    
+    Useful for this sort of thing:
+    
+        {{ names_list|escape|join:'<br />' }}
+    """
+    if isinstance(html, (list, tuple)):
+        return map(escape, html)
+    else:
+        if not isinstance(html, basestring):
+            html = str(html)
+        return html.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;').replace('"', '&quot;').replace("'", '&#39;')
 
 def linebreaks(value):
     "Converts newlines into <p> and <br />s"

docs/templates.txt

@@ -873 +873 @@
     * ``'"'`` (double quote) to ``'"'``
     * ``"'"`` (single quote) to ``'''``
 
+If applied to a list instead of a string, a copy of the list is returned with
+each item HTML-escaped. For example::
+
+    {{ guest_list|escape|join:'<br />' }}
+
 filesizeformat
 ~~~~~~~~~~~~~~