Tags and Expressions

Cubictemp evaluates expressions between tag delimiters as expressions in the specified namespace. The result is converted to a string, and placed in the rendered template. There are two flavours of delimiters - escaped:

@!...!@

and unescaped:

$!...!$

In Python, an expression can be thought of as anything that can be assigned to a variable. Arithmetic operators, boolean operators, parentheses for grouping, method/function calls, object instantiation and conditional expressions are all valid components of expressions. Python statements include things like while, print, variable assignment and full if blocks. Cubictemp allows only expressions in subtitution tags.

Example

Template:

@!foo!@ times two is @!foo*2!@
@!foo!@ squared is @!foo*foo!@
@!"yes" if (1==2) else "no"!@
key is @!mydict["key"]!@

Code:

import cubictemp
print cubictemp.File(
            "template",
            foo=3,
            mydict=dict(key="value")
        )

Output:

3 times two is 6
3 squared is 9
no
key is value

Escaping

In an escaped substitution tag, the &, <, >, ", ’ characters are converted to their corresponding HTML escape sequences. Always use the escaped substitution syntax if you can. When you really need to place HTML in a substitution tag, make sure you carefully evaluate the application context to make sure that users cannot inject malicious data.

Example

import cubictemp
print cubictemp.Template(
        "@!x!@ $!x!$",
        x = "<H1>foo</H1>"
    )

... will print:

<H1>foo</H1> &lt;H1&gt;foo&lt;/H1&gt;

Controlling Escaping

Sometimes, it is handy to be able to construct objects that bypass Cubictemp's escaping mechanism, regardless of the type of tag in which they occur. You can signal this to cubictemp by giving the object a special attribute _cubictemp_unescaped which evaluates to true.

Template, File, and named block objects all have a _cubictemp_unescaped attribute, so none of these objects will be escaped when referenced inside an escaped tag.