[Solved] Given the template code:{{ user_input }}and the user input is <script>alert('XSS')</script>, what will be rendered in the browser? | Django

Django - Security Best Practices

Given the template code:

{{ user_input }}

and the user input is <script>alert('XSS')</script>, what will be rendered in the browser?

A<script>alert('XSS')</script> shown as text

B<script>alert('XSS')</script> executed as script

CAn error message about unsafe content

DNothing will be shown

Step-by-Step Solution

Solution:

Step 1: Understand default escaping of variables
Django escapes user input by default, so HTML tags are shown as text, not executed.
Step 2: Apply this to the given input
The script tags will be converted to safe text entities and displayed literally.
Final Answer:
<script>alert('XSS')</script> shown as text -> Option A
Quick Check:
Escaped input shows tags as text = <script>alert('XSS')</script> shown as text [OK]

Quick Trick: Default escape shows tags as text, not scripts [OK]

Common Mistakes:

MISTAKES

Master "Security Best Practices" in Django

9 interactive learning modes - each teaches the same concept differently

More Django Quizzes

Given the template code: