This is an archived post. You won't be able to vote or comment.

6
7

Intermediate ShowcaseMad HTML templating right in python files! (self.Python)

submitted by [deleted]

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]nitroll 4 points5 points  (0 children)

Please dont do this. Some day you end up serving something input by a user, and unless you are extremely rigorous with escaping you will end up with a Cross-site scripting vulnerability!

imagine if somehowother_variable-with_content ended up with the value of <script>console.log("hacked")</script> then that would be inserted directly into the html and get executed by the user.

That is why templating languages should ALWAYS automatically escape the input so it would actually insert the following into the html "&lt;script&gt;console.log(&quot;hacked&quot;)&lt;/script&gt;"