Input sanitization in Flask - Mini Project: Build & Apply

Input Sanitization in Flask

📖 Scenario: You are building a simple Flask web app that accepts a username from a user through a form. To keep the app safe and clean, you need to make sure the username input is sanitized before using it.

🎯 Goal: Create a Flask app that receives a username from a form, sanitizes the input by removing unwanted characters, and then displays the cleaned username on a new page.

📋 What You'll Learn

Create a Flask app with a route to show a form

Add a route to handle form submission

Sanitize the username input by removing all characters except letters, numbers, and underscores

Display the sanitized username on a result page

💡 Why This Matters

🌍 Real World

Input sanitization is essential in web apps to prevent security issues like injection attacks and to keep data clean and consistent.

💼 Career

Understanding how to sanitize user input is a key skill for web developers to build secure and reliable applications.

1

Set up Flask app and form route

Import Flask and render_template from flask. Create a Flask app called app. Add a route for /' that returns a template called form.html.

Flask

# Your code here

Hint

Start by importing Flask and render_template, then create the app and a route for the form page.

2

Add form submission route and get username

Import request from flask. Add a route /submit with methods=['POST']. Inside the function submit(), get the username from the form using request.form['username'] and store it in a variable called username.

Flask

from flask import Flask, render_template, request

app = Flask(__name__)

@app.route('/')
def form():
    return render_template('form.html')

# Your code here

Hint

Use request.form['username'] to get the input from the form.

3

Sanitize the username input

Import re module. Use re.sub to remove all characters from username except letters, numbers, and underscores. Store the cleaned result back in username. Use the pattern r'[^\w]' and replace matches with an empty string.

Flask

import re

from flask import Flask, render_template, request

app = Flask(__name__)

@app.route('/')
def form():
    return render_template('form.html')

@app.route('/submit', methods=['POST'])
def submit():
    username = request.form['username']
    # Your code here

Hint

Use re.sub with the pattern r'[^\w]' to keep only letters, numbers, and underscores.

4

Render the sanitized username on a result page

Return render_template with 'result.html' and pass the sanitized username as a keyword argument. The key should be username.

Flask

import re

from flask import Flask, render_template, request

app = Flask(__name__)

@app.route('/')
def form():
    return render_template('form.html')

@app.route('/submit', methods=['POST'])
def submit():
    username = request.form['username']
    username = re.sub(r'[^\w]', '', username)
    # Your code here

Hint

Use render_template to show the result page with the cleaned username.

Practice

1. What is the main purpose of input sanitization in a Flask application?

easy

A. To clean user input and prevent security issues like XSS

B. To speed up the application response time

C. To format the output for better display

D. To store user data without validation

Solution

1. Step 1: Understand input sanitization

   Input sanitization means cleaning user data to avoid harmful code or attacks.

2. Step 2: Identify the main goal in Flask

   In Flask, sanitizing input helps prevent security problems like Cross-Site Scripting (XSS).

3. Final Answer:

   To clean user input and prevent security issues like XSS -> Option A

4. Quick Check:

   Input sanitization = prevent XSS [OK]

Hint: Sanitize input to stop harmful code from running [OK]

Common Mistakes:

• Thinking sanitization speeds up app
• Confusing sanitization with output formatting
• Ignoring security risks of unsanitized input

2. Which Flask function is commonly used to sanitize user input before displaying it in HTML?

easy

A. escape()

B. validate()

C. clean()

D. sanitize()

Solution

1. Step 1: Recall Flask's sanitization tools

   Flask provides the escape() function to convert special characters to safe HTML entities.

2. Step 2: Match function to purpose

   Only escape() safely converts input to prevent HTML injection.

3. Final Answer:

   escape() -> Option A

4. Quick Check:

   escape() = sanitize HTML input [OK]

Hint: Use escape() to convert special HTML characters safely [OK]

Common Mistakes:

• Using non-existent functions like sanitize()
• Confusing validation with sanitization
• Assuming clean() is a Flask function

3. What will be the output of this Flask code snippet?

from flask import escape
user_input = ''
safe_input = escape(user_input)
print(safe_input)

medium

A. SyntaxError

B.

C. alert(1)

D. <script>alert(1)</script>

Solution

1. Step 1: Understand what escape() does

   The escape() function converts special HTML characters like <, > to safe codes like < and >.

2. Step 2: Apply escape() to the input string

   The input '' becomes '<script>alert(1)</script>'.

3. Final Answer:

   <script>alert(1)</script> -> Option D

4. Quick Check:

   escape() output = <script>... [OK]

Hint: escape() changes < and > to < and > [OK]

Common Mistakes:

• Expecting raw HTML output
• Confusing escape() with removing tags
• Thinking escape() causes syntax errors

4. Identify the error in this Flask code snippet for input sanitization:

from flask import escape
user_input = request.args.get('name')
safe_input = escape(user_input)
return safe_input

medium

A. escape() should not be used on user input

B. request.args.get() returns None if 'name' missing, causing error in escape()

C. Missing import of request from flask

D. safe_input should be converted to int before returning

Solution

1. Step 1: Check the imports

   The code imports escape from Flask but uses request without importing it.

2. Step 2: Identify the resulting error

   This causes a NameError because request is undefined.

3. Final Answer:

   Missing import of request from flask -> Option C

4. Quick Check:

   Missing from flask import request [OK]

Hint: Import request from flask before using it [OK]

Common Mistakes:

• Thinking None causes TypeError in escape()
• Believing escape() should not be used on user input
• Assuming input needs int conversion

5. You want to safely display user comments on a Flask webpage. Which approach correctly sanitizes and stores the input to prevent XSS attacks?

hard

A. Sanitize input with escape() before storing in database

B. Store raw input in database, sanitize with escape() only when displaying

C. Use escape() on input and output both

D. Do not sanitize input, rely on browser security

Solution

1. Step 1: Understand best practice for input sanitization

   Sanitize user input when displaying it, not before storing, to keep original data intact.

2. Step 2: Apply escape() at output time

   Using escape() only when showing data prevents XSS without losing original input.

3. Final Answer:

   Store raw input in database, sanitize with escape() only when displaying -> Option B

4. Quick Check:

   Sanitize on output, not input [OK]

Hint: Escape user data only when displaying it [OK]

Common Mistakes:

• Sanitizing before storing causes data loss
• Sanitizing twice is unnecessary
• Ignoring XSS risks by trusting browser