Data Entry

[Peter Otten]

Chris Angelico wrote:

> On Wed, Jan 13, 2016 at 12:52 PM,  <tdsperth at gmail.com> wrote:
>> If i change the value from origin to origin energy and save - the value
>> updated to the database is correct but when the page is re displayed it
>> only shows origin in the text field - as if it ignores everything after
>> the space.
>>
>> How do I make it display the full name.
>>
> 
> To set a multi-word value as an HTML attribute, you'll need to put
> quotes around it. You might be able to get away with using %r instead
> of %s, or even just "%s", 

That is bad advice that "works" until there is a value containing 
quotes or other markup.

> but proper escaping would be the best way.

OP, that's what you should do. Either pick one of the many templating 
languages -- a simple one is

http://bottlepy.org/docs/dev/stpl.html

>>> from bottle import SimpleTemplate
>>> SimpleTemplate('... value="{{supplier}}">').render(
... supplier="<foo> 'bar' \"baz\"")
'... value="<foo> 'bar' "baz"">'

-- or at least manually apply html.escape() to the value:

>>> import html
>>> '... value="%s">' % html.escape("<foo> 'bar' \"baz\"")
'... value="<foo> &#x27;bar&#x27; "baz"">'