代码生成错误的HTML代码

Question

Input:-

   CRlist
  [['CR', 'FA', 'CL', 'TITLE'], ['409452', 'WLAN', '656885', 'Age out RSSI values from buffer in Beacon miss scenario'], ['379104', 'BT', '656928', 'CR379104: BT doesn\xe2\x80\x99t work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.']]

I have the following pythong code to generate HTML code but its generating an output which am not expecting,I pring the array values before which seem to have right data here but while using.format something is getting messedup..can anyone point what is wrong here?

for i in range(len(CRlist)):
    if i==0:
        continue
    for j in range(len(CRlist[0])):
        print "i"
        print i
        print "j"
        print j
        print "CRlist[i][j]"
        print CRlist[i][j]//right data here
        CRstring += """
        <tr>
        <td><a href="{CR}">{CR}</a></td>
        <td>{FA}</td>
        <td>{CL}</td>
        <td>{Title}</td>
        </tr>""".format(
            CR=CRlist[i][j],
            FA=CRlist[i][j],
            CL=CRlist[i][j],
            Title=CRlist[i][j],
            )
CRstring += "\n</table>\n"

My expectation of output but is getting created incorrectly

   <tr>
   <td><a href="409452">409452</a></td>
   <td>WLAN</td>
   <td>656885</td>
   <td>Age out RSSI values from buffer in Beacon miss scenario</td>
   </tr>
    ..............

Actual output,as you can the row cell data is redundant

                   <tr>
                   <td><a href="409452">409452</a></td>
                   <td>409452</td>
                   <td>409452</td>
                   <td>409452</td>
                   </tr>
                   <tr>
                   <td><a href="WLAN">WLAN</a></td>
                   <td>WLAN</td>
                   <td>WLAN</td>
                   <td>WLAN</td>
                   </tr>
                   <tr>
                   <td><a href="656885">656885</a></td>
                   <td>656885</td>
                   <td>656885</td>
                   <td>656885</td>
                   </tr>
                   <tr>
                   <td><a href="Age out RSSI values from buffer in Beacon miss scenario">Age out RSSI values from buffer in Beacon miss scenario</a></td>
                   <td>Age out RSSI values from buffer in Beacon miss scenario</td>
                   <td>Age out RSSI values from buffer in Beacon miss scenario</td>
                   <td>Age out RSSI values from buffer in Beacon miss scenario</td>
                   </tr>
                   <tr>
                   <td><a href="379104">379104</a></td>
                   <td>379104</td>
                   <td>379104</td>
                   <td>379104</td>
                   </tr>
                   <tr>
                   <td><a href="BT">BT</a></td>
                   <td>BT</td>
                   <td>BT</td>
                   <td>BT</td>
                   </tr>
                   <tr>
                   <td><a href="656928">656928</a></td>
                   <td>656928</td>
                   <td>656928</td>
                   <td>656928</td>
                   </tr>
                   <tr>
                   <td><a href="CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.">CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.</a></td>
                   <td>CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.</td>
                   <td>CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.</td>
                   <td>CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.</td>
                   </tr>
/table>

=========PLlist==========

Answer 1

This code supplies the same value to each template variable:

CR=CRlist[i][j],
FA=CRlist[i][j],
CL=CRlist[i][j],
Title=CRlist[i][j],

Obviously, that does not work as you intended. Here's another way of writing it:

TEMPLATE = """
    <tr>
    <td><a href="{CR}">{CR}</a></td>
    <td>{FA}</td>
    <td>{CL}</td>
    <td>{Title}</td>
    </tr>
"""

for i, item in enumerate(CRlist):
    if i == 0:
        continue

    CRstring += TEMPLATE.format(
        CR=item[0],
        FA=item[1],
        CL=item[2],
        Title=item[3],
    )

CRstring += "\n</table>\n"

You could even remove the i and enumerate bits by slicing the list:

for item in CRList[1:]:
    CRstring += # ...

Since you're generating HTML and are using user input (I assume, at least) and aren't escaping the HTML, you've got an XSS vulnerability. Let's fix that, too:

# near the top of the file:
import cgi

# later...
# ...
CRstring += TEMPLATE.format(
    CR=cgi.escape(item[0]),
    FA=cgi.escape(item[1]),
    # ...
)

---

Further improvements

That's all well and fine, but as someone pointed out in the comments, you may be better off using a real template engine. I like Jinja2 , personally. Here's how you'd do that:

    {%- for item in cr_list[1:] %}
        <tr>
            <td><a href="{{ item[0] | escape }}">{{ item[0] | escape }}</a></td>
            <td>{{ item[1] | escape }}</td>
            <td>{{ item[2] | escape }}</td>
            <td>{{ item[3] | escape }}</td>
        </tr>
    {%- endfor %}
</table>

Furthermore, you may want to put your data into objects. For example:

class CREntry(object):
    def __init__(self, cr, fa, cl, title):
        self.cr = cr
        self.fa = fa
        self.cl = cl
        self.title = title

Then you can convert it quite simply:

entries = [CREntry(*entry) for entry in CRlist[1:]]

Then your code becomes much more clear, being able to reference entry.title rather than item[3] .

You may also want to use the normal Python conventions as outlined in PEP 8 .

If you've got that done, your code looks like this:

import jinja2

env = jinja2.Environment(autoescape=True)  # no more | escape everywhere!

template = env.from_string(r"""
        {%- for entry in entries %}
            <tr>
                <td><a href="{{ entry.cr }}">{{ entry.cr }}</a></td>
                <td>{{ entry.fa }}</td>
                <td>{{ entry.cl }}</td>
                <td>{{ entry.title }}</td>
            </tr>
        {%- endfor %}
    </table>
""")

class CREntry(object):
    # ...

# later...
entries = [CREntry(*entry) for entry in cr_list]
cr_string = template.render(entries=entries)

A little more code elsewhere, but less when you're actually generating the HTML, and I'd say it's much more maintainable.