title: Role of semi-colon in sql injection and xss attacks
body: <p>I've been told to use (python's) cgi.escape() function to avoid sql injections and xss attacks, although I'm sure that django automatically escapes variables.  Reading about such attacks, it seems to me that the role of the semi-colon is crucial to both injecting sql and javascript.  Yet, cgi.escape doesn't seem to encode the semi-colon, leaving it bare.  Whilst other less ominous characters get converted into html entities.</p>
  
  <p>Why is this?  Wouldn't encoding ; into something like &sc; conveniently prevent these two common and major forms of attack?</p>
  
  <p>Interestingly, I've been unable to find a html entity for semi-colons.</p>