What's the easiest way to escape HTML in Python?

html, python

Solution

`html.escape` is the correct answer now, it used to be `cgi.escape` in python before 3.2. It escapes:

- `<` to `&lt;`

- `>` to `&gt;`

- `&` to `&amp;`

That is enough for all HTML.

EDIT: If you have non-ascii chars you also want to escape, for inclusion in another encoded document that uses a different encoding, like Craig says, just use:

data.encode('ascii', 'xmlcharrefreplace')

Don't forget to decode `data` to `unicode` first, using whatever encoding it was encoded.

However in my experience that kind of encoding is useless if you just work with `unicode` all the time from start. Just encode at the end to the encoding specified in the document header (`utf-8` for maximum compatibility).

Example:

>>> cgi.escape(u'<a>bá</a>').encode('ascii', 'xmlcharrefreplace')
'&lt;a&gt;b&#225;&lt;/a&gt;

Also worth of note (thanks Greg) is the extra `quote` parameter `cgi.escape` takes. With it set to `True`, `cgi.escape` also escapes double quote chars (`"`) so you can use the resulting value in a XML/HTML attribute.

EDIT: Note that cgi.escape has been deprecated in Python 3.2 in favor of `html.escape`, which does the same except that `quote` defaults to True.

Problem

Original source