Cross-site scripting not mentioned in the tutorial

[roland.illig@…]

Am I right that you don't mention the problem of cross-site scripting in the tutorial? Let's say I would add a poll like this:

question: What does <script>alert("foo");</script> do?

Would the application output a properly quoted question or would I get a JavaScript message box?

[Brian Rosner]

Protecting yourself against XSS is a fundamental security issue that any person doing web development must know and protect against. Django provides an escape template filter. I am closing this ticket since:

1. You should be using escape on user input regardless.
2. The admin site where a user would enter that (through the admin) is for trusted users and not the general public.

[roland.illig@…]

You probably wanted to attach the response to ticket 5880. This ticket is about documentation, not admin.

In the examples in the tutorial, the "escape" function is not mentioned. This makes the readers believe that just including the raw text into the HTML code is the right way to do it.

Neither of the three following pages has the word "escape" in it:
​http://www.djangoproject.com/documentation/tutorial01/
​http://www.djangoproject.com/documentation/tutorial02/
​http://www.djangoproject.com/documentation/tutorial03/

[James Bennett]

Django's default autoescaping of template output makes this moot, and there's a section in the template docs where people can learn how to turn it off if they can't stand it.