碼生成不正確的HTML代碼

Question

輸入： -

CRlist 
    [['CR', 'FA', 'CL', 'TITLE'], ['409452', 'WLAN', '656885', 'Age out RSSI values from buffer in Beacon miss scenario'], ['379104', 'BT', '656928', 'CR379104: BT doesn\xe2\x80\x99t work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.']] 

我有以下pythong代碼來生成HTML代碼，但其產生其不是在期望的輸出，I普林數組值似乎有正確的數據之前，其在這裏，但使用.format東西越來越messedup ..任何人都可以指出什麼是錯的？

for i in range(len(CRlist)): 
    if i==0: 
     continue 
    for j in range(len(CRlist[0])): 
     print "i" 
     print i 
     print "j" 
     print j 
     print "CRlist[i][j]" 
     print CRlist[i][j]//right data here 
     CRstring += """ 
     <tr> 
     <td><a href="{CR}">{CR}</a></td> 
     <td>{FA}</td> 
     <td>{CL}</td> 
     <td>{Title}</td> 
     </tr>""".format(
      CR=CRlist[i][j], 
      FA=CRlist[i][j], 
      CL=CRlist[i][j], 
      Title=CRlist[i][j], 
      ) 
CRstring += "\n</table>\n" 

我的輸出的預期，但得到正確創建

<tr> 
    <td><a href="409452">409452</a></td> 
    <td>WLAN</td> 
    <td>656885</td> 
    <td>Age out RSSI values from buffer in Beacon miss scenario</td> 
    </tr> 
    .............. 

實際輸出，可以將行單元格的數據是冗餘的

    <tr> 
        <td><a href="409452">409452</a></td> 
        <td>409452</td> 
        <td>409452</td> 
        <td>409452</td> 
        </tr> 
        <tr> 
        <td><a href="WLAN">WLAN</a></td> 
        <td>WLAN</td> 
        <td>WLAN</td> 
        <td>WLAN</td> 
        </tr> 
        <tr> 
        <td><a href="656885">656885</a></td> 
        <td>656885</td> 
        <td>656885</td> 
        <td>656885</td> 
        </tr> 
        <tr> 
        <td><a href="Age out RSSI values from buffer in Beacon miss scenario">Age out RSSI values from buffer in Beacon miss scenario</a></td> 
        <td>Age out RSSI values from buffer in Beacon miss scenario</td> 
        <td>Age out RSSI values from buffer in Beacon miss scenario</td> 
        <td>Age out RSSI values from buffer in Beacon miss scenario</td> 
        </tr> 
        <tr> 
        <td><a href="379104">379104</a></td> 
        <td>379104</td> 
        <td>379104</td> 
        <td>379104</td> 
        </tr> 
        <tr> 
        <td><a href="BT">BT</a></td> 
        <td>BT</td> 
        <td>BT</td> 
        <td>BT</td> 
        </tr> 
        <tr> 
        <td><a href="656928">656928</a></td> 
        <td>656928</td> 
        <td>656928</td> 
        <td>656928</td> 
        </tr> 
        <tr> 
        <td><a href="CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.">CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.</a></td> 
        <td>CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.</td> 
        <td>CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.</td> 
        <td>CR379104: BT doesnΓÇÖt work that Riva neither sends HCI Evt for HID ACL data nor response to HCI_INQUIRY after entering into pseudo sniff subrating mode.</td> 
        </tr> 
/table> 

======== = PLlist ==========

Answer 1

此代碼提供相同的值ue給每個模板變量：

CR=CRlist[i][j], 
FA=CRlist[i][j], 
CL=CRlist[i][j], 
Title=CRlist[i][j], 

很明顯，這不符合你的意圖。下面是寫它的另一種方式：

TEMPLATE = """ 
    <tr> 
    <td><a href="{CR}">{CR}</a></td> 
    <td>{FA}</td> 
    <td>{CL}</td> 
    <td>{Title}</td> 
    </tr> 
""" 

for i, item in enumerate(CRlist): 
    if i == 0: 
     continue 

    CRstring += TEMPLATE.format(
     CR=item[0], 
     FA=item[1], 
     CL=item[2], 
     Title=item[3], 
    ) 

CRstring += "\n</table>\n" 

你甚至可以通過分割列表中刪除i和enumerate位：

for item in CRList[1:]: 
    CRstring += # ... 

既然你生成HTML和使用用戶輸入（我假設，至少）並沒有逃避HTML，你有一個XSS漏洞。讓我們來解決這個問題，太：

# near the top of the file: 
import cgi 

# later... 
# ... 
CRstring += TEMPLATE.format(
    CR=cgi.escape(item[0]), 
    FA=cgi.escape(item[1]), 
    # ... 
) 

---

進一步改進

這一切都很好，很好，但有人在評論中指出的那樣，你可以使用真正的模板引擎會更好。我個人喜歡Jinja2。你可以這樣做：

{%- for item in cr_list[1:] %} 
     <tr> 
      <td><a href="{{ item[0] | escape }}">{{ item[0] | escape }}</a></td> 
      <td>{{ item[1] | escape }}</td> 
      <td>{{ item[2] | escape }}</td> 
      <td>{{ item[3] | escape }}</td> 
     </tr> 
    {%- endfor %} 
</table> 

此外，你可能想把你的數據放入對象。例如：

class CREntry(object): 
    def __init__(self, cr, fa, cl, title): 
     self.cr = cr 
     self.fa = fa 
     self.cl = cl 
     self.title = title 

然後你就可以很簡單地將其轉換：

entries = [CREntry(*entry) for entry in CRlist[1:]] 

然後你的代碼變得更加清晰，能夠引用entry.title而非item[3]。

您可能還想使用PEP 8中列出的常規Python約定。

如果你已經有了做，你的代碼看起來是這樣的：

import jinja2 

env = jinja2.Environment(autoescape=True) # no more | escape everywhere! 

template = env.from_string(r""" 
     {%- for entry in entries %} 
      <tr> 
       <td><a href="{{ entry.cr }}">{{ entry.cr }}</a></td> 
       <td>{{ entry.fa }}</td> 
       <td>{{ entry.cl }}</td> 
       <td>{{ entry.title }}</td> 
      </tr> 
     {%- endfor %} 
    </table> 
""") 

class CREntry(object): 
    # ... 

# later... 
entries = [CREntry(*entry) for entry in cr_list] 
cr_string = template.render(entries=entries) 

多一點的代碼在其他地方，但不太當你實際生成HTML，我會說這是多更易維護。