[Solved] You have this Flask template code:<span>{{ feedback|safe }}</span>Users report XSS attacks after submitting feedback. What is the most probable cause? | Flask

Flask - Security Best Practices

You have this Flask template code:

<span>{{ feedback|safe }}</span>

Users report XSS attacks after submitting feedback. What is the most probable cause?

AFlask automatically escapes variables even with |safe filter

BThe variable feedback is not passed to the template

CThe |safe filter disables escaping, allowing malicious scripts

DThe template syntax is incorrect causing errors

Step-by-Step Solution

Solution:

Step 1: Understand |safe filter
The |safe filter tells Jinja2 not to escape the variable content.
Step 2: Impact on security
If user input contains scripts, they will be rendered as executable HTML, causing XSS.
Final Answer:
The |safe filter disables escaping, allowing malicious scripts -> Option C
Quick Check:
|safe disables escaping, enabling XSS [OK]

Quick Trick: |safe disables escaping; use cautiously [OK]

Common Mistakes:

MISTAKES

Master "Security Best Practices" in Flask

9 interactive learning modes - each teaches the same concept differently

More Flask Quizzes

You have this Flask template code: