diff --git a/django/utils/html.py b/django/utils/html.py index 6c9779a156..a0d1e82dcf 100644 --- a/django/utils/html.py +++ b/django/utils/html.py @@ -25,7 +25,7 @@ def escape(html): "Returns the given HTML with ampersands, quotes and carets encoded" if not isinstance(html, basestring): html = str(html) - return html.replace('&', '&').replace('<', '<').replace('>', '>').replace('"', '"') + return html.replace('&', '&').replace('<', '<').replace('>', '>').replace('"', '"').replace("'", ''') def linebreaks(value): "Converts newlines into
and
s"
diff --git a/docs/templates.txt b/docs/templates.txt
index 9d137019a0..88f14dd3b9 100644
--- a/docs/templates.txt
+++ b/docs/templates.txt
@@ -844,7 +844,8 @@ Escapes a string's HTML. Specifically, it makes these replacements:
* ``"&"`` to ``"&"``
* ``<`` to ``"<"``
* ``>`` to ``">"``
- * ``'"'`` (double quote) to ``"""``
+ * ``'"'`` (double quote) to ``'"'``
+ * ``"'"`` (single quote) to ``'''``
filesizeformat
~~~~~~~~~~~~~~