XSS prevention in templates in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What will this Django template output?

Consider this Django template snippet:

{% autoescape on %}{{ user_input }}{% endautoescape %}

If user_input is <script>alert('XSS')</script>, what will be rendered in the browser?

Django

{% autoescape on %}{{ user_input }}{% endautoescape %}

A Script tag removed completely

B alert('XSS')

C <script>alert('XSS')</script>

D <script>alert('XSS')</script>

💡 Hint

Think about what autoescape does to HTML special characters.

With autoescape on, Django converts special characters like < and > into HTML entities, preventing the script from running.

📝 Syntax

intermediate

Which template syntax disables autoescaping for a variable?

In Django templates, how do you output a variable user_input without escaping HTML?

A {{ user_input|raw }}

B {% autoescape off %}{{ user_input }}{% endautoescape %}

C {{ user_input|escape }}

D {{ user_input|safe }}

💡 Hint

One option is a filter that marks the string as safe.

The |safe filter tells Django not to escape the variable, rendering HTML as is.

🔧 Debug

advanced

Why does this template still allow XSS?

Given this template:

{{ user_input|safe }}

and user_input contains <img src=x onerror=alert(1)>, why is this a security risk?

Django

{{ user_input|safe }}

A Because |safe disables escaping, allowing scripts in user input to run

B Because the img tag is removed automatically

C Because Django autoescapes by default, so this is safe

D Because onerror attribute is sanitized by Django

💡 Hint

Think about what |safe does to user input.

Using |safe disables escaping, so malicious HTML or scripts in user input run in the browser.

🧠 Conceptual

advanced

How does Django's autoescaping protect against XSS?

Which statement best describes Django's autoescaping feature in templates?

A It converts special HTML characters in variables to safe entities to prevent script execution

B It removes all HTML tags from user input automatically

C It encrypts user input before rendering

D It disables JavaScript in the browser

💡 Hint

Think about what happens to < and > characters.

Autoescaping replaces <, >, &, and quotes with HTML entities so browsers show them as text, not code.

❓ state_output

expert

What is the output count of links rendered safely?

In this Django template:

{% for link in links %}{{ link|urlize }}
{% endfor %}

Given links = ['http://example.com', 'javascript:alert(1)', 'https://safe.com'], how many links will be rendered as clickable safe URLs?

Django

{% for link in links %}{{ link|urlize }}<br>{% endfor %}

A 0

B 2

C 1

D 3

💡 Hint

urlize only makes safe URLs clickable, ignoring javascript: links.

urlize converts http and https URLs to links but ignores javascript: URLs for safety.