How can I transfer a python object for use in a JavaScript variable?

Question

I'm using Bottle and Python 2.7.

I would like to pass a list variable from my Bottle's controller to the view page, where it will be used in a JavaScript variable.

@app.route('/foo'):
def foo():
    l = [{'name':'Matthew'}]
    return template('foo', l=l)

I've also done:

l = json.dumps([{'name':'Matthew'}]

In my view

<script type="text/javascript">
    $(document).ready({
        var l = {{l}}
        l.forEach(function(entry) {
            console.log(entry);
        });
    });
</script>

However my console says I have a syntax error. When I open the HTML, it is rendered like:

var l = [{&quot;name&quot;: &quot;Matthew&quot;]

How can I transfer a python object for use in a JavaScript variable?

David-SkyMesh · Accepted Answer · 2014-06-24 00:59:00Z

1

The substitutions between {{ and }} are HTML Entity encoded to prevent XSS amongst other things.

Try this:

var l = {{!l}};

answered Jun 24, 2014 at 0:59

David-SkyMesh

5,1721 gold badge35 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Matthew Moisen Over a year ago

Is it unsafe if I do this?

David-SkyMesh Over a year ago

It's unsafe if l was user-generated content. It's not unsafe if you know that l contains only valid JSON.

Brenton Alker · Accepted Answer · 2014-06-24 00:59:56Z

1

Bottle (via, the SimpleTemplate engine) is escaping the output to prevent XSS vulnerability. This is good, generally. You can disable the escaping temporarily using ! like:

var l = {{!l}};

The docs for it are here

answered Jun 24, 2014 at 0:59

Brenton Alker

9,1223 gold badges38 silver badges37 bronze badges

2 Comments

Matthew Moisen Over a year ago

Is it unsafe if I do this?

Brenton Alker Over a year ago

It's safest to assume not, hence it being escaped by default. It can be though, depending on the source of the data. If it comes from a trusted source, such as a developer or (maybe) an admin, it might be okay. Otherwise, no.

Collectives™ on Stack Overflow

How can I transfer a python object for use in a JavaScript variable?

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related