Input sanitization in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to get user input safely from a form in Flask.

Flask

from flask import Flask, request
app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    user_input = request.form.get([1])
    return f"You entered: {user_input}"

Drag options to blanks, or click blank then click option'

Ainput

B"input"

C"user_input"

Duser_input

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the field name without quotes causes an error.

Using request.args.get instead of request.form.get for POST data.

The form field name must be passed as a string to request.form.get().

2fill in blank

medium

Complete the code to sanitize user input by escaping HTML characters.

Flask

from flask import escape

@app.route('/display')
def display():
    raw_input = request.args.get('text')
    safe_input = [1](raw_input)
    return f"Safe output: {safe_input}"

Drag options to blanks, or click blank then click option'

Aescape

Bclean

Csanitize

Dstr

Attempts:

3 left

💡 Hint

Common Mistakes

Using str() does not sanitize input.

Using undefined functions like sanitize or clean.

Flask's escape function converts special characters to HTML-safe sequences.

3fill in blank

hard

Fix the error in the code to prevent injection by validating input length.

Flask

def validate_input(user_text):
    if len(user_text) > [1]:
        return False
    return True

Drag options to blanks, or click blank then click option'

A-1

B'1000'

CNone

D1000

Attempts:

3 left

💡 Hint

Common Mistakes

Using a string '1000' instead of integer 1000.

Using None or negative numbers causing logic errors.

The length limit must be an integer, not a string or None.

4fill in blank

hard

Fill both blanks to create a dictionary comprehension that filters and sanitizes inputs.

Flask

inputs = {'name': '<b>Alice</b>', 'age': '25', 'comment': '<script>'}
safe_inputs = {k: escape(v) for k, v in inputs.items() if len(v) [1] [2]

Drag options to blanks, or click blank then click option'

A>

B<

C10

D5

Attempts:

3 left

💡 Hint

Common Mistakes

Using '>' instead of '<' reverses the filter logic.

Using 5 filters too strictly, missing valid inputs.

We filter values with length less than 10 to sanitize short inputs.

5fill in blank

hard

Fill all three blanks to create a safe Flask route that gets, sanitizes, and validates input.

Flask

from flask import Flask, request, escape
app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    raw = request.form.get([1])
    safe = [2](raw)
    if len(safe) > [3]:
        return "Input too long", 400
    return f"Received: {safe}"

Drag options to blanks, or click blank then click option'

A"comment"

Bescape

C100

D"input"

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong field names like 'comment'.

Not escaping input before length check.

Using string instead of integer for length.

We get the 'input' field, escape it, and check length against 100.