Processing Template Strings

Python
# t-strings (t"...") produce Template objects, NOT strings.
# Unlike f-strings, interpolated values stay as live objects until you process them.

name = "World"
template = t"Hello, {name}!"

print(type(template))  # <class 'string.templatelib.Template'>

# Iterate over strings and interpolations in order
for item in template:
    print(repr(item))
# 'Hello, '
# Interpolation(value='World', expression='name', conversion=None, format_spec='')
# '!'

# Convert to a plain string manually (no auto-escaping happens for you)
result = "".join(
    str(item.value) if hasattr(item, "value") else item
    for item in template
)
print(result)  # "Hello, World!"

Progress:

• Identify whether you need a Template (t-string, deferred) or an f-string (immediate string)
• Write a renderer that walks template.strings / template.interpolations or iterates the Template directly
• Apply conversion (!s/!r/!a) manually if present
• Apply format_spec manually (typically via format(value, spec))
• Apply domain-specific escaping (HTML, SQL, shell) to interpolated values only — never to literal segments
• Join everything into the final output

Step-by-step renderer pattern

Python
from string.templatelib import Template, Interpolation

def render(template: Template, escape=str) -> str:
    parts = []
    for item in template:
        if isinstance(item, Interpolation):
            value = item.value
            if item.conversion == "s":
                value = str(value)
            elif item.conversion == "r":
                value = repr(value)
            elif item.conversion == "a":
                value = ascii(value)
            if item.format_spec:
                value = format(value, item.format_spec)
            parts.append(escape(str(value)))
        else:
            parts.append(item)  # literal text: NOT escaped
    return "".join(parts)

Example 1: HTML auto-escaping (the canonical t-string use case) Input:

Python
import html

def html_escape(template):
    parts = []
    for item in template:
        if isinstance(item, str):
            parts.append(item)
        else:
            parts.append(html.escape(str(item.value)))
    return "".join(parts)

user_input = "<script>alert(1)</script>"
page = t"<p>Comment: {user_input}</p>"
print(html_escape(page))

Output:

<p>Comment: &lt;script&gt;alert(1)&lt;/script&gt;</p>

Example 2: Safe SQL parameterization Input:

Python
def to_sql(template):
    sql_parts = []
    params = []
    for item in template:
        if isinstance(item, str):
            sql_parts.append(item)
        else:
            sql_parts.append("?")
            params.append(item.value)
    return "".join(sql_parts), tuple(params)

name = "Robert'); DROP TABLE students;--"
query = t"SELECT * FROM users WHERE name = {name}"
sql, params = to_sql(query)
print(sql, params)

Output:

SELECT * FROM users WHERE name = ? ("Robert'); DROP TABLE students;--",)

Example 3: Inspecting format spec and conversion Input:

Python
value = 3.14159
t_obj = t"{value!r:.2f}"
interp = t_obj.interpolations[0]
print(interp.value, interp.conversion, interp.format_spec)

Output:

3.14159 r .2f

(Note: conversion and format_spec are metadata only — applying both is your responsibility, e.g. format(repr(value), ".2f") would error since repr returns a str; typically you choose one or handle order deliberately.)