Hello, "Ryan M. Dolensek" wrote:

try...

<dtml-call "REQUEST.set('htmldesc',utils.httpEscapedString(REQUEST['description']))">

huh??, what is this, i'm not aware of anything resembling this being in zope's core, i think you are using some type of custom lib. if not i'd like to hear about it?

ryan

Soren Roug wrote:

...

Hi,

I can render text that potentially has html in it safely with

<dtml-var description html_quote>

but what if I want to assign the quoted result to another variable.

I tried

<dtml-call "REQUEST.set('htmldesc',html_quote(REQUEST['description']))">

It didn't work. How do I solve this problem?

the html_quote of dtml-var is done on rendering so you really can't capture the variable in a transformed state. the solution is to roll your own pythonmethod. here's one to the trick. html_encode ttw python method PARAMETERS: text BODY string = _.string character_entities={"'&'":"&","<":"<", "'>'":">","\213": '<', "\233":'>','"':"""} text=str(text) for re,name in character_entities.items(): if string.find(text, re) >= 0: text=string.join(string.split(text,re),name) return text /END BODY so for your example you would do <dtml-call "REQUEST.set('htmldesc', html_encode(description))"> qualifying description if you need to. cheers kapil