def publish(request, category_id=None):
    if category_id:
        get_object_or_404(
            Category.objects.visible(),
            pk=category_id)

    user = request.user
    form = TopicForm(
        user=user,
        data=post_data(request),
        initial={'category': category_id})
    cform = CommentForm(
        user=user,
        data=post_data(request))
    if (is_post(request) and
            all([form.is_valid(), cform.is_valid()]) and
            not request.is_limited()):
        if not user.st.update_post_hash(form.get_topic_hash()):
            return redirect(
                request.POST.get('next', None) or
                form.get_category().get_absolute_url())
        # wrap in transaction.atomic?
        topic = form.save()
        cform.topic = topic
        comment = cform.save()
        comment_posted(comment=comment, mentions=cform.mentions)
        return redirect(topic.get_absolute_url())
    return render(
        request=request,
        template_name='spirit/topic/publish.html',
        context={'form': form, 'cform': cform})
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.