Django Design Patterns and Best Practices: Industry-standard web development techniques and solutions using Python, 2nd Edition

by Arun Ravindran

class XSSDemoView(View): def get(self, request): # WARNING: This code is insecure and prone to XSS attacks # *** Do not use it!!! *** if 'q' in request.GET: return HttpResponse("Searched for: {}".format( request.GET['q'])) else: return HttpResponse("""<form method="get"> <input type="text" name="q" placeholder="Search" value=""> <button type="submit">Go</button> </form>""") The preceding code is a View class that shows a search form when accessed without any GET parameters. If the search form is submitted, it shows the Search string exactly as entered by the user in the form. Now, open this view in a dated browser (say, IE 8) and enter the following search term in the form and submit it: <script>alert("pwned")</script>

Basic example of cross-site-scripting