building up HTML using strings, especially where user-supplied data is involved, makes me nervous. I seem to be able to pass all kinds of random things through but I haven't made any specific injection happen yet (I can get enough through to break underlying model URLs and get django to show a traceback though) - are you sure all user input is validated enough before it gets to this point?