Can the order of elements in a list cause a bug in a for loop?

Question

I'm playing with a simple script to escape certain HTML characters, and am encountering a bug which seems to be caused by the order of elements in my list escape_pairs. I'm not modifying the lists during a loop, so I can't think of any Python/programming principles I'm overlooking here.

escape_pairs = [(">", "&gt;"),("<","&lt;"),('"',"&quot;"),("&","&amp;")]

def escape_html(s):
    for (i,o) in escape_pairs:
        s = s.replace(i,o)
    return s

print escape_html(">")
print escape_html("<")
print escape_html('"')
print escape_html("&")

returns

>
<
"
&

However when I switch the order of the elements in my escape_pairs list to the bug disappears

>>> escape_pairsMod = [("&","&amp;"),("<","&lt;"),('"',"&quot;"),(">", "&gt;")]

&gt;
&lt;
&quot;
&amp;

Answer 1

Yes, in your first implementation, it can.

Lets take the case of > and the list -

escape_pairs = [(">", "&gt;"),("<","&lt;"),('"',"&quot;"),("&","&amp;")]

When iterating through escape_pairs , you first get > and replace it with > . This causes the string to become '> . Then you keep on iterating, and at the end you find ("&","&") , and you replace the & in the string with & , making the result the one you get right now.

When you change the order of the lists, you get the correct result. But still this is just because you first took into consideration & and only after that you took other in consideration.

You can use str.translate instead to translate the string coorectly , according to a dictionary. Example -

>>> escape_pairs = [(">", "&gt;"),("<","&lt;"),('"',"&quot;"),("&","&amp;")]
>>> escape_dict = dict(escape_pairs)
>>> t = str.maketrans(escape_dict)
>>> ">".translate(t)
'&gt;'
>>> "> & <".translate(t)
'&gt; &amp; &lt;'

---

But if what you want to do is HTML escape the string, then you should use the standard library - cgi -

>>> import cgi
>>> cgi.escape("< > &")
'&lt; &gt; &amp;'

Also, if you are using Python 3.2 + , you can use html.escape instead, Example -

>>> import html
>>> html.escape("< > &")
'&lt; &gt; &amp;'

Answer 2

I will use the first time you call your escape_html function as an example:
print escape_html(">")

Problem:
When you s.replace(i,o) the first time:

s = ">"

s = s.replace(i,o)

">".replace(">", ">")

s = ">"

But now when you get to the the last replace(), the value of s was saved from before so:

s = ">"

s = s.replace(i,o)

">".replace("&","&") #replaces the "&" in `">"` with `"&"` 

s = ">"

Why Does Order Matter?
The reason this depends on order is because when the .replace("&","&") comes first it'll be:

s = ">"

s = s.replace(i,o)

">".replace("&","&") #No "&"'s to replace so:

s = ">" 

Then your program goes on to work as expected.

Solution:
Because there will always be just one instance of the change you are trying to make in the list, just return once you have made that change.

def escape_html(s):
    for (i,o) in escape_pairs:
        s = s.replace(i,o)
        return s