z
¶ (c) Technocore - All Rights Reserved.
NOTICE: All information contained herein is, and remains
the property of TechnoCore.
The intellectual and technical concepts contained
herein are proprietary to TechnoCore and dissemination of this information or reproduction of this material
is strictly forbidden unless prior written permission is obtained
from TechnoCore.
¶ ObjTextYoutube
The ObjTextYoutube object is designed to generate the necessary HTML code to embed a YouTube video within a web page. It simplifies the process of creating responsive video embeds.
¶ Methods
¶ process(video_id: str, title: str = "") -> str
This is the primary method of the class. It takes a YouTube video ID and an optional title and returns an HTML string that creates a responsive embedded video player.
Parameters:
video_id(str): The unique identifier for the YouTube video (e.g.,dQw4w9WgXcQ). This is a required parameter.title(str, optional): An optional title that will be displayed in a header above the video. Defaults to an empty string.
Returns:
- (str): A string of HTML code for the embedded video. If the
video_idis not provided, it returns an empty string.
Example Usage:
youtube_embed = ObjTextYoutube()
video_html = youtube_embed.process(
video_id="dQw4w9WgXcQ",
title="My Favorite Video"
)
print(video_html)
This would output the following HTML:
<div class='box box-solid'>
<div class='box-header with-border'>My Favorite Video</div>
<div class='embed-responsive embed-responsive-16by9'>
<iframe class='embed-responsive-item'
src='https://www.youtube.com/embed/dQw4w9WgXcQ'
frameborder='0' ></iframe>
</div>
</div>
¶ Markup and escaping
The markup is in ObjTextYoutube.yaml (templates), not inline
in Python. Applied 2026-08-16.
The two inputs are handled differently, on purpose:
| Input | Treatment | Why |
|---|---|---|
param1 — video id |
validated against [A-Za-z0-9_-], else render nothing |
it lands in a src this module chooses to trust |
param2 — title |
escaped with escape_html() |
free text, so it is quoted rather than rejected |
Validating beats escaping for the id. A YouTube id is that charset and
nothing else, so anything outside it is not an id that needs quoting —
it is not an id. Both were interpolated raw before, which made
{youtube:x' onload=alert(1)} a working attribute break-out.