This works: <a tal:attributes="href python:'javascript:alert(\'hi\')'">hi</a> This doesn't: <a tal:attributes="href python:'javascript:alert(\'hi;\')'">hi</a> It looks like tal:attributes may be reading the semicolon as the end of the definition, event though it's in a python string. Is there any explanation other than 'bug'?