Input sanitization in Flask - Step-by-Step Execution

Concept Flow - Input sanitization

User submits input

↓

Receive input in Flask route

↓

Sanitize input

↓

Check for unsafe content

↓

Reject input

↓

Return error

This flow shows how Flask receives user input, sanitizes it to remove unsafe parts, then either rejects or processes it safely.

Execution Sample

Flask

from flask import Flask, request, escape
app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    user_input = request.form['data']
    safe_input = escape(user_input)
    return f"You entered: {safe_input}"

This Flask route gets user input from a form, sanitizes it using escape(), then returns the safe text.

Execution Table

Step	Action	Input Value	Sanitized Value	Output
1	User submits form with data	<script>alert(1)</script>
2	Flask receives input	<script>alert(1)</script>
3	Sanitize input using escape()	<script>alert(1)</script>	&lt;script&gt;alert(1)&lt;/script&gt;
4	Return sanitized input in response		&lt;script&gt;alert(1)&lt;/script&gt;	You entered: &lt;script&gt;alert(1)&lt;/script&gt;
5	End			Response sent safely

💡 Input is sanitized to prevent unsafe HTML/script, then safely returned.

Variable Tracker

Variable	Start	After Step 1	After Step 3	Final
user_input	None	<script>alert(1)</script>	<script>alert(1)</script>	<script>alert(1)</script>
safe_input	None	None	&lt;script&gt;alert(1)&lt;/script&gt;	&lt;script&gt;alert(1)&lt;/script&gt;

Key Moments - 2 Insights

Why do we use escape() on user input?

escape() converts special characters like < and > to safe codes, preventing harmful scripts from running. See execution_table step 3 where input changes.

What happens if we skip sanitization?

Without sanitization, unsafe HTML or scripts can run in the browser, causing security risks. The execution_table shows how sanitization changes input to safe text.

Visual Quiz - 3 Questions

Look at the execution table, what is the sanitized value at step 3?

A alert(1)

B &lt;script&gt;alert(1)&lt;/script&gt;

C <script>alert(1)</script>

D None

💡 Hint

Check the 'Sanitized Value' column at step 3 in the execution_table.

At which step does Flask receive the user input?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Look at the 'Action' column in execution_table to find when input is received.

If we remove escape(), what would the output at step 4 be?

A You entered: <script>alert(1)</script>

B You entered: &lt;script&gt;alert(1)&lt;/script&gt;

C You entered: alert(1)

D Error

💡 Hint

Without sanitization, output matches raw input. See variable_tracker for safe_input changes.

Concept Snapshot

Input sanitization in Flask:
- Receive user input via request.form
- Use escape() to convert unsafe characters
- Prevents scripts/HTML injection
- Always sanitize before output
- Keeps app and users safe

Full Transcript

This example shows how Flask handles user input safely. When a user submits data, Flask receives it in the route function. The input may contain unsafe characters like < or > which can run harmful scripts if shown directly. Using the escape() function converts these characters to safe codes like &lt; and &gt;. This sanitized input is then returned in the response, preventing security risks. The execution table traces each step: receiving input, sanitizing it, and returning safe output. Variables track how user_input holds the raw data and safe_input holds the sanitized version. Key moments clarify why sanitization is needed and what happens if skipped. The visual quiz tests understanding of these steps. This process keeps web apps secure by stopping malicious code from running.

Practice

1. What is the main purpose of input sanitization in a Flask application?

easy

A. To clean user input and prevent security issues like XSS

B. To speed up the application response time

C. To format the output for better display

D. To store user data without validation

Solution

1. Step 1: Understand input sanitization

   Input sanitization means cleaning user data to avoid harmful code or attacks.

2. Step 2: Identify the main goal in Flask

   In Flask, sanitizing input helps prevent security problems like Cross-Site Scripting (XSS).

3. Final Answer:

   To clean user input and prevent security issues like XSS -> Option A

4. Quick Check:

   Input sanitization = prevent XSS [OK]

Hint: Sanitize input to stop harmful code from running [OK]

Common Mistakes:

• Thinking sanitization speeds up app
• Confusing sanitization with output formatting
• Ignoring security risks of unsanitized input

2. Which Flask function is commonly used to sanitize user input before displaying it in HTML?

easy

A. escape()

B. validate()

C. clean()

D. sanitize()

Solution

1. Step 1: Recall Flask's sanitization tools

   Flask provides the escape() function to convert special characters to safe HTML entities.

2. Step 2: Match function to purpose

   Only escape() safely converts input to prevent HTML injection.

3. Final Answer:

   escape() -> Option A

4. Quick Check:

   escape() = sanitize HTML input [OK]

Hint: Use escape() to convert special HTML characters safely [OK]

Common Mistakes:

• Using non-existent functions like sanitize()
• Confusing validation with sanitization
• Assuming clean() is a Flask function

3. What will be the output of this Flask code snippet?

from flask import escape
user_input = ''
safe_input = escape(user_input)
print(safe_input)

medium

A. SyntaxError

B.

C. alert(1)

D. <script>alert(1)</script>

Solution

1. Step 1: Understand what escape() does

   The escape() function converts special HTML characters like <, > to safe codes like < and >.

2. Step 2: Apply escape() to the input string

   The input '' becomes '<script>alert(1)</script>'.

3. Final Answer:

   <script>alert(1)</script> -> Option D

4. Quick Check:

   escape() output = <script>... [OK]

Hint: escape() changes < and > to < and > [OK]

Common Mistakes:

• Expecting raw HTML output
• Confusing escape() with removing tags
• Thinking escape() causes syntax errors

4. Identify the error in this Flask code snippet for input sanitization:

from flask import escape
user_input = request.args.get('name')
safe_input = escape(user_input)
return safe_input

medium

A. escape() should not be used on user input

B. request.args.get() returns None if 'name' missing, causing error in escape()

C. Missing import of request from flask

D. safe_input should be converted to int before returning

Solution

1. Step 1: Check the imports

   The code imports escape from Flask but uses request without importing it.

2. Step 2: Identify the resulting error

   This causes a NameError because request is undefined.

3. Final Answer:

   Missing import of request from flask -> Option C

4. Quick Check:

   Missing from flask import request [OK]

Hint: Import request from flask before using it [OK]

Common Mistakes:

• Thinking None causes TypeError in escape()
• Believing escape() should not be used on user input
• Assuming input needs int conversion

5. You want to safely display user comments on a Flask webpage. Which approach correctly sanitizes and stores the input to prevent XSS attacks?

hard

A. Sanitize input with escape() before storing in database

B. Store raw input in database, sanitize with escape() only when displaying

C. Use escape() on input and output both

D. Do not sanitize input, rely on browser security

Solution

1. Step 1: Understand best practice for input sanitization

   Sanitize user input when displaying it, not before storing, to keep original data intact.

2. Step 2: Apply escape() at output time

   Using escape() only when showing data prevents XSS without losing original input.

3. Final Answer:

   Store raw input in database, sanitize with escape() only when displaying -> Option B

4. Quick Check:

   Sanitize on output, not input [OK]

Hint: Escape user data only when displaying it [OK]

Common Mistakes:

• Sanitizing before storing causes data loss
• Sanitizing twice is unnecessary
• Ignoring XSS risks by trusting browser