Add spaces around variables. SECURITY FIX : http://www.djangoproject.com/weblog/2010/dec/22/security/