{"action":"created","issue":{"url":"https://api.github.com/repos/lamby/django-slack/issues/33","repository_url":"https://api.github.com/repos/lamby/django-slack","labels_url":"https://api.github.com/repos/lamby/django-slack/issues/33/labels{/name}","comments_url":"https://api.github.com/repos/lamby/django-slack/issues/33/comments","events_url":"https://api.github.com/repos/lamby/django-slack/issues/33/events","html_url":"https://github.com/lamby/django-slack/issues/33","id":134591579,"number":33,"title":"Over-aggressive HTML entity escaping","user":{"login":"clokep","id":517124,"avatar_url":"https://avatars.githubusercontent.com/u/517124?v=3","gravatar_id":"","url":"https://api.github.com/users/clokep","html_url":"https://github.com/clokep","followers_url":"https://api.github.com/users/clokep/followers","following_url":"https://api.github.com/users/clokep/following{/other_user}","gists_url":"https://api.github.com/users/clokep/gists{/gist_id}","starred_url":"https://api.github.com/users/clokep/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clokep/subscriptions","organizations_url":"https://api.github.com/users/clokep/orgs","repos_url":"https://api.github.com/users/clokep/repos","events_url":"https://api.github.com/users/clokep/events{/privacy}","received_events_url":"https://api.github.com/users/clokep/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-02-18T14:14:27Z","updated_at":"2016-02-18T21:37:22Z","closed_at":null,"body":"By default, `django-slack` escapes all HTML entites (well really Django templates do, but that's essentially the same thing here). This is [documented](https://django-slack.readthedocs.org/#usage), but the documentation should probably be expanded to say that [only `<`, `>` and `&` should be escaped](https://api.slack.com/docs/formatting#how_to_escape_characters). In fact the slack documentation says NOT to escape other characters:\r\n\r\n> That's it. **Don't HTML entity-encode the entire message.** Of course, when you send your message using URL-encoding, you'll still need to URL encode the ampersand.\r\n\r\nSpecifically, I was running into an issue where I had a message with a single quote (`'`) that was showing up as an entity in slack (`&#39;`). The examples in the documentation show usage of the [`safe` templatetag](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#safe), but it was not clear to me why this was happening. Calling this out explicitly would be nice.\r\n\r\nI'm unsure if this is a documentation or a code issue, but the work around is to pass variables through the `safe` templatetag or disable `autoescape`."},"comment":{"url":"https://api.github.com/repos/lamby/django-slack/issues/comments/185933479","html_url":"https://github.com/lamby/django-slack/issues/33#issuecomment-185933479","issue_url":"https://api.github.com/repos/lamby/django-slack/issues/33","id":185933479,"user":{"login":"lamby","id":133209,"avatar_url":"https://avatars.githubusercontent.com/u/133209?v=3","gravatar_id":"","url":"https://api.github.com/users/lamby","html_url":"https://github.com/lamby","followers_url":"https://api.github.com/users/lamby/followers","following_url":"https://api.github.com/users/lamby/following{/other_user}","gists_url":"https://api.github.com/users/lamby/gists{/gist_id}","starred_url":"https://api.github.com/users/lamby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lamby/subscriptions","organizations_url":"https://api.github.com/users/lamby/orgs","repos_url":"https://api.github.com/users/lamby/repos","events_url":"https://api.github.com/users/lamby/events{/privacy}","received_events_url":"https://api.github.com/users/lamby/received_events","type":"User","site_admin":false},"created_at":"2016-02-18T21:37:22Z","updated_at":"2016-02-18T21:37:22Z","body":"> a template-tag which escapes the 3 characters Slack wants escaped\r\n\r\nOh, that's a neat idea. Fancy giving it a go?\r\n\r\nI *think* we should be able to avoid the explicit ``{% load slacksafe %}`` given that we control the call to ``render_to_string``.\r\n\r\nWould also prefer ``|escapeslack`` to mirror ``|escapejs``."}}