python / intermediate
Snippet
Mitigating Cross-Site Scripting via Custom Form Sanitation Methods
Accepting raw text input from users exposes web applications to Stored Cross-Site Scripting (XSS) attacks. Overriding the clean_<field_name> hook in a Django form ensures data is sanitized (e.g., removing HTML tags with strip_tags) before it ever reaches database storage or gets rendered back to users.
snippet.py
python
1
2
3
4
5
6
7
8
9
10
from django import formsfrom django.utils.html import strip_tagsclass UserBioForm(forms.Form):bio = forms.CharField(widget=forms.Textarea)def clean_bio(self):raw_bio = self.cleaned_data.get('bio', '')sanitized_bio = strip_tags(raw_bio)return sanitized_bio
django
Breakdown
1
class UserBioForm(forms.Form):
Defines a standard Django form for user biography submissions.
2
def clean_bio(self):
Implements a field-specific clean hook triggered automatically during form validation.
3
sanitized_bio = strip_tags(raw_bio)
Strips out HTML tags from the user input string to neutralize script injection risks.