Input sanitization in Flask - Step-by-Step Execution

Concept Flow - Input sanitization

User submits input

↓

Receive input in Flask route

↓

Sanitize input

↓

Check for unsafe content

↓

Reject input

↓

Return error

This flow shows how Flask receives user input, sanitizes it to remove unsafe parts, then either rejects or processes it safely.

Execution Sample

Flask

from flask import Flask, request, escape
app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    user_input = request.form['data']
    safe_input = escape(user_input)
    return f"You entered: {safe_input}"

This Flask route gets user input from a form, sanitizes it using escape(), then returns the safe text.

Execution Table

Step	Action	Input Value	Sanitized Value	Output
1	User submits form with data	<script>alert(1)</script>
2	Flask receives input	<script>alert(1)</script>
3	Sanitize input using escape()	<script>alert(1)</script>	&lt;script&gt;alert(1)&lt;/script&gt;
4	Return sanitized input in response		&lt;script&gt;alert(1)&lt;/script&gt;	You entered: &lt;script&gt;alert(1)&lt;/script&gt;
5	End			Response sent safely

💡 Input is sanitized to prevent unsafe HTML/script, then safely returned.

Variable Tracker

Variable	Start	After Step 1	After Step 3	Final
user_input	None	<script>alert(1)</script>	<script>alert(1)</script>	<script>alert(1)</script>
safe_input	None	None	&lt;script&gt;alert(1)&lt;/script&gt;	&lt;script&gt;alert(1)&lt;/script&gt;

Key Moments - 2 Insights

Why do we use escape() on user input?

escape() converts special characters like < and > to safe codes, preventing harmful scripts from running. See execution_table step 3 where input changes.

What happens if we skip sanitization?

Without sanitization, unsafe HTML or scripts can run in the browser, causing security risks. The execution_table shows how sanitization changes input to safe text.

Visual Quiz - 3 Questions

Look at the execution table, what is the sanitized value at step 3?

A alert(1)

B &lt;script&gt;alert(1)&lt;/script&gt;

C <script>alert(1)</script>

D None

💡 Hint

Check the 'Sanitized Value' column at step 3 in the execution_table.

At which step does Flask receive the user input?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Look at the 'Action' column in execution_table to find when input is received.

If we remove escape(), what would the output at step 4 be?

A You entered: <script>alert(1)</script>

B You entered: &lt;script&gt;alert(1)&lt;/script&gt;

C You entered: alert(1)

D Error

💡 Hint

Without sanitization, output matches raw input. See variable_tracker for safe_input changes.

Concept Snapshot

Input sanitization in Flask:
- Receive user input via request.form
- Use escape() to convert unsafe characters
- Prevents scripts/HTML injection
- Always sanitize before output
- Keeps app and users safe

Full Transcript

This example shows how Flask handles user input safely. When a user submits data, Flask receives it in the route function. The input may contain unsafe characters like < or > which can run harmful scripts if shown directly. Using the escape() function converts these characters to safe codes like &lt; and &gt;. This sanitized input is then returned in the response, preventing security risks. The execution table traces each step: receiving input, sanitizing it, and returning safe output. Variables track how user_input holds the raw data and safe_input holds the sanitized version. Key moments clarify why sanitization is needed and what happens if skipped. The visual quiz tests understanding of these steps. This process keeps web apps secure by stopping malicious code from running.