flask url parameters with spaces generates urls with spaces

Question

I'm trying to pass a user supplied string as a Flask URL parameter. url_for(func_name, param="string with spaces") or similar generates a URL with spaces.

If the user enter a string with spaces the generated url has spaces it seems to work.

Also if I enter a URL with %20 it seems to redirect to a url with spaces. I thought URLs with spaces were a bad idea.

How do I get it to work right (url_for and redirection)? Or should I just accept it?

P.S. Is passing a user supplied string as a parameter safe? If not how should I sanitize the user input string?

This is your browser showing you spaces; everything is working as intended. — Martijn Pieters
– Martijn Pieters, Commented Feb 18, 2014 at 11:12

Martijn Pieters · Accepted Answer · 2014-02-18 12:06:07Z

2

No, Flask generates URLs properly URL encoded; demoing with an existing application:

>>> with app.test_request_context('/'):
...     print url_for('core.city', city='new york')
... 
/new%20york

Your browser on the other hand may elect to show such URLs decoded for ease of reading.

url_for() quotes input to be URL-safe; encoded URLs cannot contain values that could be interpreted as HTML, so you are safe there as far as user-supplied values are concerned.

edited Feb 18, 2014 at 12:06

answered Feb 18, 2014 at 11:17

Martijn Pieters

1.1m326 gold badges4.2k silver badges3.4k bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Roman A. Taycher Over a year ago

I just tries copy/paste and it looks like you are right. OTOH when I add random junk to the end my 404 page which displays the request.url has space not %20 s. Weird.

Collectives™ on Stack Overflow

flask url parameters with spaces generates urls with spaces

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related