django escapejs and simplejson

Question

I'm trying to encode a Python array into json using simplejson.dumps:

In [30]: s1 = ['test', '<script>']

In [31]: simplejson.dumps(s1)
Out[31]: '["test", "<script>"]'

Works fine.

But I want to escape the strings first (using escapejs from Django) before calling simplejson.dumps:

In [35]: s_esc
Out[35]: [u'test', u'\\u003Cscript\\u003E']

In [36]: print simplejson.dumps(s_esc)
["test", "\\u003Cscript\\u003E"]

My problem is: I want the escaped string to be: ["test", "\u003Cscript\u003E"] instead of ["test", "\\u003Cscript\\u003E"]

I can use replace:

In [37]: print simplejson.dumps(s_esc).replace('\\\\', '\\')
["test", "\u003Cscript\u003E"]

But is this a good approach? I just want to escape the strings first before encoding them to json. So there will be no syntax errors when I use them in template.

Thanks. :)

Regulator

Answer 1

simplejson 2.1.0 and later include a JSONEncoderForHTML encoder that does exactly what you want. To use it in your example:

>>> s1 = ['test', '<script>']
>>> simplejson.dumps(s1, cls=simplejson.encoder.JSONEncoderForHTML)
'["test", "\\u003cscript\\u003e"]'

I ran into this recently where I didn't have control over the code that was generating the data structures, so I couldn't escape the strings as they were being assembled. JSONEncoderForHTML solved the problem neatly at the point of output.

Of course, you'll need to have simplejson 2.1.0 or later. (Django used to come with an older version, and Django 1.5 deprecated django.utils.simplejson entirely.) If you can't upgrade for some reason, the JSONEncoderForHTML code is relatively small and could probably be pulled into earlier code or used with Python 2.6+'s json package -- though I haven't tried this myself

Nottinghamshire

Yes, you're right addslashes didn't work for me. I didn't know that there is JSONEncoderForHTML. Thank you very much for helping me. :) – Regulator

Answer 2

You're doing the operations in the wrong order. You should dump your data to a JSON string, then escape that string. You can do the escaping with the addslashes Django filter.

Menashem

I wouldn't recommend addslashes for generating json or html -- I believe it's meant for SQL prep. addslashes won't protect against something like '</script>' in one of your strings leaking into your html. The original question mentioned escapejs, and that's exactly the right escape to use for JavaScript output. – Nottinghamshire