HTML Sanitization and the NH3 Project

Do you need to transfer an extensive data collection for a science project? What’s the best way to send executable code over the wire for distributed processing? What are the different ways to serialize data in Python? Christopher Trudeau is back on the show this week, bringing another batch of PyCoder’s Weekly articles and projects.

Christopher shares a tutorial by Real Python author Bartosz Zaczyński called “Serialize Your Data With Python.” This comprehensive guide moves beyond XML and JSON to explore multiple data formats and their potential use cases. It’s a deep dive into the topic and provides a thorough resource for future reference.

We also discuss a Real Python tutorial about naming conventions in Python that use single and double underscores. The piece covers differentiating between public and non-public names in APIs, writing safe classes for subclassing purposes, and avoiding name clashes with keywords.

We also share several other articles and projects from the Python community, including a couple of release announcements and news items, a discussion about never being taught how to construct quality software, building a small REPL in Python, using the key parameter in Python functions and methods, a framework for RESTful APIs using Flask and SQLAlchemy, and a Rust-based HTML sanitizer for your Python projects.

Topics:

• 00:00:00 – Introduction
• 00:02:47 – JIT Coming to Python 3.13
• 00:03:13 – A copy-and-patch JIT compiler - Pull Request #113465
• 00:03:54 – Django bugfix releases issued: 4.2.9 and 5.0.1
• 00:04:24 – Single and Double Underscores in Python Names
• 00:16:42 – Building a Small REPL in Python
• 00:20:07 – The Key to the key Parameter in Python
• 00:25:23 – Video Course Spotlight
• 00:26:44 – Serialize Your Data With Python
• 00:30:23 – You Are Never Taught How to Build Quality Software
• 00:48:43 – flask-muck: RESTful APIs Using Flask and SQLAlchemy
• 00:51:26 – nh3: Python binding to Ammonia HTML sanitizer Rust crate
• 00:53:33 – Thanks and goodbye

News:

• JIT Coming to Python 3.13 – Slides related to the upcoming JIT commit for Python 3.13. Note that GitHub paginates the slides if you don’t download them, so click the More Pages button to keep reading.
• A copy-and-patch JIT compiler by brandtbucher - Pull Request #113465
• Django bugfix releases issued: 4.2.9 and 5.0.1 - Weblog Django

Show Links:

• Single and Double Underscores in Python Names – In this tutorial, you’ll learn a few Python naming conventions involving single and double underscores (_). You’ll learn how to use this character to differentiate between public and non-public names in APIs, write safe classes for subclassing purposes, avoid name clashes, and more.
• Building a Small REPL in Python – Learn how to write your own REPL by building on top of the one that comes with Python. With a few lines of code, you can customize Python’s REPL environment as your own.
• The Key to the key Parameter in Python – A parameter named key is present in several Python functions, such as sorted(). This article explores what it is and how to use it.
• Serialize Your Data With Python – In this in-depth tutorial, you’ll explore the world of data serialization in Python. You’ll compare and use different data serialization formats, serialize Python objects and executable code, and handle HTTP message payloads.

Discussion:

• You Are Never Taught How to Build Quality Software – Learning how to build quality software isn’t part of computer science education. How do we learn it?
• Hacker News discussion about the article

Projects:

• flask-muck: RESTful APIs Using Flask and SqlAlchemy
• nh3: Python binding to Ammonia HTML sanitizer Rust crate

Additional Links:

• PEP 8: The Style Guide for Python Code
• Python’s Magic Methods: Leverage Their Power in Your Classes – Real Python
• A Philosophy of Software Design Book - John Ousterhout
• A Philosophy of Software Design - John Ousterhout - Talks at Google - YouTube
• Episode #49: The Challenges of Developing Into a Python Professional – The Real Python Podcast
• Django: Sanitize Incoming HTML Fragments With nh3 – Allowing users to input HTML in comments or blog posts is problematic and can lead to exploits on your site. For years, the Django community used django-bleach, but since its deprecation, Adam has been using nh3, a Rust-based HTML sanitizer.
• nh3 · PyPI

Level up your Python skills with our expert-led courses:

• Working With JSON in Python
• Writing Beautiful Pythonic Code With PEP 8
• Serializing Objects With the Python pickle Module

Support the podcast & join our community of Pythonistas