Question

I am creating a website where you “post”, and the form content is saved in a MySql database, and upon loading the page, is retrieved, similar to facebook. I construct all the posts and insert raw html into a template. The thing is, as I was testing, I noticed that I could write javascript or other HTML into the form and submit it, and upon reloading, the html or JS would treated as source code, not a post. I figured that some simple encoding would do the trick, but using <form accept-charset="utf-8"> is not working. Is there an efficient way to prevent this type of security hole?

Answer 1

I found this one, that talks about XSS prevention in python.

Python library for XSS filtering?