Template strings (t-strings) in Python 3.14

A comment box receives <script>alert("hi")</script>, and a page that puts the comment into its HTML with an f-string sends that script to every visitor’s browser. No helper could have stopped it: by the time any code saw the text, the comment and the markup were one finished string.

A t-string, t"Hello {name}", keeps them apart. It evaluates to a string.templatelib.Template, an object that holds the text you wrote and each interpolated value separately, so a function can decide how to combine them: escape every value for HTML, or turn every value into an SQL parameter. Template strings arrived in Python 3.14 through PEP 750. Use them when a helper builds HTML, SQL, shell commands or log records from values; for text that only people read, f-strings stay the simpler choice.

A t-string evaluates to a Template, not to text

from string.templatelib import Interpolation

name = "Asha"
amount = 1234.5
greeting = t"Hi {name!r}, you owe {amount:,.2f} by Friday."

print(type(greeting))
print(greeting.strings)
print(greeting.values)

# Iterating gives the text you wrote and an Interpolation for every {...}, in order.
for part in greeting:
    if isinstance(part, Interpolation):
        print(f"  value={part.value!r} expression={part.expression!r} "
              f"conversion={part.conversion!r} format_spec={part.format_spec!r}")
    else:
        print(f"  text {part!r}")

# A Template has no text of its own: str() shows its repr.
print(str(greeting))

<class 'string.templatelib.Template'>
('Hi ', ', you owe ', ' by Friday.')
('Asha', 1234.5)
  text 'Hi '
  value='Asha' expression='name' conversion='r' format_spec=''
  text ', you owe '
  value=1234.5 expression='amount' conversion=None format_spec=',.2f'
  text ' by Friday.'
Template(strings=('Hi ', ', you owe ', ' by Friday.'), interpolations=(Interpolation('Asha', 'name', 'r', ''), Interpolation(1234.5, 'amount', None, ',.2f')))

The template keeps its pieces in three tuples: strings holds the text you wrote, always one item more than there are interpolations, interpolations holds an Interpolation for every pair of braces, and values holds the evaluated values. Step through the template that the program built:

An interpolation carries four things: value, the result of the expression; expression, the source text between the braces; conversion, "r", "s", "a" or None; and format_spec, the text after the colon. Iterating the template gives the text and the interpolations, in order, and skips empty text.

Two details in the output matter. The conversionconversion: !r, !s or !a after the expression in an f-string's braces: the value is turned into text with repr(), str() or ascii() before it is formatted. f"{city!r}" shows a string in quotes. More in “f-strings and the format mini-language” !r and the format specformat specification: The code after the colon in a replacement field, such as >12,.2f, that sets fill and alignment, sign, width, grouping, precision and type. format(value, spec) applies one on its own. More in “f-strings and the format mini-language” ,.2f were recorded but not applied: the value is still the float 1234.5, and applying them, or ignoring them, is the processing function’s choice. And str() of the template printed its repr, not a greeting, because a Template has no text of its own: code that forgets to process a template shows Template(strings=… on screen instead of hiding the bug.

The prefix can be combined with r for a raw t-string, rt"\d{4}-{year}", where backslashes stay as written, but not with b: there are no bytes templates. Any expression an f-stringf-string: A string literal with f before its opening quote, such as f"{price:.2f}". The expressions in its braces are evaluated when the line runs, and their values are put into the text. More in “f-strings and the format mini-language” accepts works between the braces, and the expression attribute keeps its source text, which processors use as a name, for example for a log field.

A processing function escapes the values and keeps the text

import html
from string.templatelib import Interpolation, Template


def render_html(template: Template) -> str:
    """Join a template, escaping every interpolated value for HTML."""
    out = []
    for part in template:
        if isinstance(part, Interpolation):
            out.append(html.escape(str(part.value)))   # a value: escape it
        else:
            out.append(part)                           # text written in the code: keep it
    return "".join(out)


user = "Ravi <admin>"
comment = '<script>alert("hi")</script> & thanks'

print(render_html(t"<p><b>{user}</b>: {comment}</p>"))
# An f-string has already joined everything, so nothing can tell the values apart any more.
print(f"<p><b>{user}</b>: {comment}</p>")

<p><b>Ravi &lt;admin&gt;</b>: &lt;script&gt;alert(&quot;hi&quot;)&lt;/script&gt; &amp; thanks</p>
<p><b>Ravi <admin></b>: <script>alert("hi")</script> & thanks</p>

render_html() is a processing function, the piece that gives a template its meaning. It keeps the text written in the code, the <p> and <b> tags, and passes every value through html.escape(), so the user name and the comment arrive as visible characters instead of markup. The same loop, written at the top level so that every pass can be stepped through:

from html import escape
from string.templatelib import Interpolation

user = "Ravi <admin>"
page = t"<p><b>{user}</b></p>"
out = []
for part in page:
    if isinstance(part, Interpolation):
        out.append(escape(part.value))
    else:
        out.append(part)
print("".join(out))
print(f"<p><b>{user}</b></p>")

<p><b>Ravi &lt;admin&gt;</b></p>
<p><b>Ravi <admin></b></p>

The f-string on the last line had no such chance: by the time any function received it, the <script> from the comment was part of one finished string, indistinguishable from the tags the programmer wrote. That separation is the whole idea, and PEP 750 names injection attacks, such as cross-site scriptingcross-site scripting: A weakness in which text from one user reaches a page without escaping, so the browser reads it as markup and can run code in other visitors' browsers. Escaping output for its place in the page prevents it. More in “XML and HTML parsing without security holes”, among its reasons. Escaping still has to suit the place where the value lands: html.escape() protects text between tags and quoted attribute values, but a link in href also needs its scheme checked, and code inside <script> needs a different encoder altogether.

f-strings, t-strings and string.Template differ in when values join the text

All three put values into text. Read the table row by row for when the values join the written text, and who decides how:

A processor can also format, recurse, bind and log

A real processor usually does more than escape. string.templatelib.convert() applies an interpolation’s !r, !s or !a conversion the way an f-string would. format(value, spec) applies its format spec, such as ,.2f. A value that is itself a template, such as a list item built with t"<li>{item}</li>", can be rendered recursively. An SQL processor writes a ? placeholderplaceholder (SQL): A marker such as ? or :name where a value goes in an SQL statement. The driver sends the values apart from the SQL text, and the database binds them to the compiled statement as data. More in “SQLite databases with sqlite3” for every value and returns the values as parameters. A logging processor returns a readable message together with the values as separate fields. Templates can also be joined with +, but only to other templates.

Check yourself

Eight questions on the three ideas above follow, one at a time, in the order your answers call for.

Processors for SQL, logs and nested HTML, with an injection attempt run Pro: opens with a Pro, Premium or Ultimate pass

How templates compare, join and evaluate, with their cost measured Pro: opens with a Pro, Premium or Ultimate pass

Interview questions

Key takeaways

• t"..." evaluates to a string.templatelib.Template, not a str: its strings hold the written text, and its interpolations hold each value, expression, conversion and format_spec.
• Conversions and format specs are recorded, not applied, and str() of a template shows its repr.
• A processing function gives a template its meaning: it escapes the values for HTML, binds them for SQL or keeps them as fields for logs, while the written text stays as it is.
• t-strings need Python 3.14, and sqlite3 still takes its ? placeholders and parameters.