Input sanitization in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is input sanitization in Flask?

Input sanitization is the process of cleaning and validating user input to prevent harmful data from causing security issues or errors in a Flask application.

beginner

Why is input sanitization important in web applications?

It helps protect the app from attacks like SQL injection, cross-site scripting (XSS), and ensures the app works correctly by accepting only expected data.

intermediate

Which Flask extension can help with input validation and sanitization?

WTForms is a popular Flask extension that helps create forms with built-in validation and sanitization features.

intermediate

How can you sanitize a string input to prevent XSS in Flask?

You can use the MarkupSafe library (used by Flask) to escape HTML characters, or manually escape characters like <, >, &, ", and '.

beginner

What is a simple way to validate an email input in Flask?

Use WTForms with an EmailField and the Email validator to check if the input looks like a valid email address.

What does input sanitization mainly protect against in Flask apps?

A Security attacks like XSS and SQL injection

B Faster page loading

C Better user interface design

D Database backups

Input sanitization cleans user input to prevent security attacks such as cross-site scripting (XSS) and SQL injection.

Which Flask extension helps with form validation and sanitization?

A WTForms

B Flask-Migrate

C Flask-Login

D Flask-Mail

WTForms is used in Flask to create forms with validation and sanitization features.

What is a common method to prevent XSS attacks in Flask?

A Disabling JavaScript

B Escaping HTML characters in user input

C Using CSS styles

D Increasing server RAM

Escaping HTML characters like < and > in user input prevents malicious scripts from running.

Which of these is NOT a part of input sanitization?

A Validating input format

B Escaping dangerous characters

C Encrypting user passwords

D Removing unwanted code

Encrypting passwords is important but is not part of input sanitization; it is part of data security.

How can you validate an email input in Flask easily?

A Checking if input contains '@' manually

B No validation is needed

C Using Flask-Mail to send a test email

D Using WTForms EmailField with Email validator

WTForms provides an EmailField and Email validator to check if input is a valid email format.

Explain what input sanitization is and why it matters in Flask applications.

Think about how user input can cause problems if not cleaned.

Describe how you would use WTForms in Flask to sanitize and validate user input.

Consider the steps to build a form with validation.