urlbecause the url here is embedded in htmlit must at least be escaped according to html conventions ( any characters must become &lt;)and any spaces should be translated to signs per url conventions cgi escape(urlcall followed by the string url replace(""+"would take us this farand would probably suffice for most cases that approach is not quite enough in generalthoughbecause html escaping conventions are not the same as url conventions to robustly escape urls embedded in html codeyou should instead call urllib parse quote_plus on the url stringor at least most of its componentsbefore adding it to the html text the escaped result also satisfies html escape conventionsbecause urllib parse translates more characters than cgi escapeand the in url escapes is not special to html html and url conflictsbut there is one more astonishingly subtle (and thankfully rarewrinkleyou may also have to be careful with characters in url strings that are embedded in html code ( within hyperlink tagsthe symbol is both query parameter separator in urls (? = & = and the start of escape codes in html (&lt;consequentlythere is potential for collision if query parameter name happens to be the same as an html escape sequence code the query parameter name ampfor instancethat shows up as &amp= in parameters two and beyond on the url may be treated as an html escape by some html parsersand translated to &= even if parts of the url string are url-escapedwhen more than one parameter is separated by &the separator might also have to be escaped as &ampaccording to html conventions to see whyconsider the following html hyperlink tag with query parameter names namejobampsectand lthello when rendered in most browsers testedincluding internet explorer on windows this url link winds up looking incorrectly like this (the character in the first of these is really non-ascii section marker)file py?name= &job= &=cs= <= file py?name= &job= &= % = % = result in ie result in chrome ( is <the first two parameters are retained as expected (name=ajob= )because name is not preceded with an and &job is not recognized as valid html character escape code howeverthe &amp&sectand &lt parts are interpreted as special characters because they do name valid html escape codeseven without trailing semicolon to see this for yourselfopen the example package' test-escapes html file in your browserand highlight or select its linkthe query names may be taken as html server-side scripting