用python进行HTML编码解码

Question

I am sending encoded HTML to my python ajax handler by jQuery. Here is my jQuery code:

var animal_data = encodeURI( $('#animal-list-table').html() ); // something like this: %0A%20%20%20%20%20%20%20%20
mydata = 'action=send_mail&animal_data='+animal_data
$.ajax({
    type: 'POST',
    url: '/customer/templates/slakteweb/ajax-handler',
    data: mydata,
    processData: false,
    success: function(result){
        console.log(result);
    }
});

In the ajax handler, I have tried like this:

import urllib
animal_data = site.param('animal_data')
animal_data_html = urllib.unquote(animal_data).decode('utf8')

But I wanted to print the HTML tags and everything so that I can send it as HTML email. What is the best way to do that?

Answer 1

For POST data you don't need the encodeURI function, since POST data is not sent as part of the URI/URL. If you don't do that you don't need to decode anything on the server side either.

It's generally a very bad idea not validating the input you get from untrusted source (here: browser). Even if you think you do the whole coding on client-side, consider it unsafe. Long story short: the best and commonly used way is parsing the content as plain text, not HTML.