diff --git a/django/utils/html.py b/django/utils/html.py index 6c9779a156..a0d1e82dcf 100644 --- a/django/utils/html.py +++ b/django/utils/html.py @@ -25,7 +25,7 @@ def escape(html): "Returns the given HTML with ampersands, quotes and carets encoded" if not isinstance(html, basestring): html = str(html) - return html.replace('&', '&').replace('<', '<').replace('>', '>').replace('"', '"') + return html.replace('&', '&').replace('<', '<').replace('>', '>').replace('"', '"').replace("'", ''') def linebreaks(value): "Converts newlines into

and
s" diff --git a/docs/templates.txt b/docs/templates.txt index 9d137019a0..88f14dd3b9 100644 --- a/docs/templates.txt +++ b/docs/templates.txt @@ -844,7 +844,8 @@ Escapes a string's HTML. Specifically, it makes these replacements: * ``"&"`` to ``"&"`` * ``<`` to ``"<"`` * ``>`` to ``">"`` - * ``'"'`` (double quote) to ``"""`` + * ``'"'`` (double quote) to ``'"'`` + * ``"'"`` (single quote) to ``'''`` filesizeformat ~~~~~~~~~~~~~~