Simon Willison’s Weblog

Why the h can’t Rails escape HTML automatically? It would be a pretty huge change, but auto-escaping in Rails 2.0 could close up a lot of accidental XSS holes. # 1st December 2007, 8:34 pm

sorl-thumbnail. This looks like a decent attempt at a generic Django thumbnailing service, but I’m always wary of code that allows URL hackers to create large numbers of files that will be cached to disk. UPDATE: My mistake, thumbnail creation can only be caused by template authors. # 27th November 2007, 7:17 pm

Using django.newforms with Pylons. It’s always good to see Django components used outside of the framework itself. For the record, you can avoid the DJANGO_SETTINGS_MODULE environment variable entirely using django.conf.settings.configure (search for it). # 27th November 2007, 3:01 pm

Newforms, part 1. James Bennett provides a detailed description of Django’s newforms (not so new now though, they’ve been around for over a year), complete with attractive diagrams. # 23rd November 2007, 11:54 pm

Django Evolution. Really smart take on the problem of updating database tables to reflect changes to Django models. Code that automatically modifies your database tables can be pretty scary, but Evolution seems to hit the right balance. # 23rd November 2007, 11:49 pm

Professional Python Frameworks: Web 2.0 Programming with Django and Turbogears. Apparently published by Wrox in October 2007, beating the “official” Django book by just over a month. Has anyone seen this on bookshelves yet? # 16th November 2007, 9:16 pm

Django Changeset 6671. Malcolm Tredinnick: “Implemented auto-escaping of variable output in templates”. Fantastic—Django now has protection against accidental XSS holes, turned on by default. # 14th November 2007, 5:05 pm

Django Book Update. It’s done! Went to the printer on Friday, due in bookstores in the second week of December (just in time for Christmas). Congrats to Adrian and Jacob. # 14th November 2007, 12:59 am

Django documentation bookmarklets. James Bennett continues his month-long series of daily Django tutorials with documentation for one of Django’s best kept secrets: application introspection HTTP headers and bookmarklets that make use of them. # 8th November 2007, 10:59 am

Hello Revver.com 2.0. Revver, one of the more established video startups, have launched their new version which is powered by Django. # 2nd November 2007, 7:03 am

Django security fix released. Django’s internationalisation system has a denial of service hole in it; you’re vulnerable if you are using the i18n middleware. Fixes have been made available for trunk, 0.96, 0.95 and 0.91. # 26th October 2007, 9:47 pm

Using the extra() QuerySet modifier in Django for WeGoEat. You can use select() on a QuerySet to obtain extra values using subqueries. # 24th October 2007, 7:28 pm

ASP.NET MVC Framework. This looks pretty good. It includes clean URL support that’s very similar to how Django does things (with a nice alternative syntax for developers who don’t like regular expressions). # 22nd October 2007, 1:45 pm

LastGraph. Now Available. Andrew Godwin has relaunched his LastGraph Last.fm graphing application. The new version is built on Django and S3 and uses Andrew’s Graphication graphing library based on Cairo. # 15th October 2007, 10:02 pm

Two Weeks With Django. A Rails developer tries Django but ends up switching back to Rails. I think we could definitely take some steps towards making the initial user experience a bit smoother—currently you have to decide things like how you’ll serve static files and where you’ll keep your templates. Once you’ve got that lot set up it’s mostly plain sailing but it does mean there’s a bit of a bump in the learning curve. # 15th October 2007, 9:51 pm

Two months with Ruby on Rails. Good rant—covers both the good and the bad. The first complaint is the lack of XSS protection by default in the template language. Django has the same problem, but the solution was 90% there when I saw Malcolm at OSCON. # 9th October 2007, 12:23 pm

tranquil. Inspired take on the Django ORM to SQLAlchemy problem: lets you define your models with the Django ORM but use SQLAlchemy to run queries against them. # 9th October 2007, 2:30 am

DbMigration—a schema migration tool for Django. Nice and simple tool for adding schema migrations to a Django application. # 27th September 2007, 3:04 pm

djangogigs.com—from idea to release in 6 hours. Now that’s what I call rapid development. # 26th September 2007, 4:53 pm

Django GridContainer. Media Temple’s virtualized Django hosting is now accepting applications for beta testers. # 22nd September 2007, 12:01 pm

Zope3 for Djangoers. I prefer “Djangonauts”, personally. Useful overview of Zope 3 for people with Django experience (first of a multi-part series). # 14th September 2007, 3:20 pm

Restructured Text to Anything. Slick set of online tools for converting Restructured Text (one of the more mature wiki-style markup languages) to HTML or PDF. Includes a nice looking API. Powered by Django. # 13th September 2007, 3:54 pm

django-sphinx (via) More code from Curse Gaming; this time a really nice API for adding Sphinx full-text search to a Django model. # 9th September 2007, 12:35 am

Advanced Django. Slides from my hour long tutorial at PyCon UK this morning. Most of the material was adapted from OSCON, but I also added a new section covering newforms. # 8th September 2007, 1 pm

Django on Jython: What I’ve done until now. It’s not quite there yet (the new Jython is Python 2.2 with a few 2.3 features; Django requires 2.3 at least) but it’s looking pretty promising. # 4th September 2007, 2:53 am

Django vs feedparser on dates. Some useful tips in the comments. I find Python’s timezone stuff endlessly frustrating: I know it can do what I want, but it always takes me a ridiculously long time to figure out the necessary incantations. # 2nd September 2007, 10:17 am

A Django Cache Status. Django view to display stats pulled from your memcached server. # 25th August 2007, 2:08 pm

Satchmo 0.5 Release. Django powered e-commerce application, “the webshop for perfectionists with deadlines”. # 22nd August 2007, 10:36 pm

Django and the iPhone tutorial. How to install SSH, Python and Django on your iPhone and get Django running against the call database. Less complicated than I expected. # 21st August 2007, 11:34 am