Question

181

Passing a JSON object from Flask to JavaScript

rated 0 times [ 188] [ 7] / answers: 1 / hits: 42042 / 7 Years ago, tue, february 28, 2017, 12:00:00

I'm having troubles getting a Flask/Python variable passed to Javascript.

Basically, I'm importing from MySQL and have tried rendering the return in three different ways.

(43.8934276, -103.3690243), (47.052060, -91.639868), (45.1118, -95.0396) that is the output when my dict item has the following ran on it.

new_list = [tuple(d.values()) for d in MySQL_Dict] output = ', '.join('(' + ', '.join(i) + ')' for i in new_list)

This method is no good, but I added it for detail, it's not in the right format at all.

I pass the python dict directly to the template which looks like this

({'lat': '43.8934276', 'lng': '-103.3690243'}, {'lat': '47.052060', 'lng': '-91.639868'}, {'lat': '45.1118', 'lng': '-95.0396'})

Then on the the template side I've tried the following JavaScript lines

 var other_coords = {{ MySQL_Dict|tojson }}; 

 var other_coords = {{ MySQL_Dict|tojson|safe }};

 var still_more = JSON.parse(other_coords);

None of which work, together or separately.

I've also tried sending the dictionary from the view using json_out = json.dumps(My_Dict) which does not work either.

This is all with the goal of getting the lat, lng coords from the MySQL DB to the Google Maps API script. The thing that is so confusing to me is that if I just paste the json.dump results from the view into the Google Maps script it works perfectly (after the quotes are removed) but if I use a variable it will not work for me. Does anyone have suggestions?

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

angelr

Add To Favorites

Follow

Total Points: 399

Total Questions: 96

Total Answers: 101

Location: Finland

Member since Sun, May 21, 2023

1 Year ago

answered 7 Years ago kylanalis · Accepted Answer

It seems that the currently accepted answer (by @BrettJ) has a possible security flaw in it: if the object we pass to javascript has some string with a single quote inside, this single quote will not be escaped by json.dumps, thus allowing to inject arbitrary code into javascript. It is better to use Flask's tojson() template filter, see the docs, as it makes proper escaping of all such characters (replace them with unicode codes).

Here is my solution:

view.py

from flask import Flask, render_template



app = Flask(__name__)



@app.route('/')

def hello_world():

    user = {'firstname': Mr., 'lastname': My Father's Son}

    return render_template(index.html, user=user)



if __name__ == '__main__':

    app.run()

index.html

<p>Hello, <span id=username></span></p>

<script>

    var user = JSON.parse('{{ user | tojson | safe}}');

    document.getElementById('username').innerHTML = user.firstname +   +

            user.lastname;

</script>

Generated JS looks like:

var user = JSON.parse('{firstname: Mr., lastname: My Fatheru0027s Son}');

which is perfectly safe. For example, if we'd use json.dumps-powered solution, we'd get

var user = JSON.parse('{firstname: Mr., lastname: My Father's Son}');

which is syntactically incorrect (to say the least).