From 6580938d822a522aad7c4beb30383da8520b70a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ahmet=20G=C3=B6r?= Date: Tue, 17 Mar 2026 15:59:41 +0300 Subject: [PATCH] Added a real world html escaping example --- docs/quickstart.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/quickstart.rst b/docs/quickstart.rst index 712ba977..ddf25e7c 100644 --- a/docs/quickstart.rst +++ b/docs/quickstart.rst @@ -147,8 +147,10 @@ how you're using untrusted data. name = request.args.get("name", "Flask") return f"Hello, {escape(name)}!" -If a user submits ``/hello?name=``, escaping causes -it to be rendered as text, rather than running the script in the user's browser. +For example, if a web app displays user reviews without escaping input, an attacker could submit +```` . +Now, any user viewing that page would unknowingly send their cookies to the attacker. +This is a classic Cross-Site Scripting (XSS) attack, preventable by escaping or encoding user input before rendering. Routing