title: Django valid XSS attack example
body: <p>I found Django is pretty powerful to handle XSS attacks, I just wrote a simple textfield form, at template, xss_form.html:</p>
  
  <pre><code>&lt;html&gt;
  &lt;head&gt;&lt;title&gt;XSS Forms&lt;/title&gt;&lt;/head&gt;
  &lt;body&gt;
  &lt;form action="" method="get"&gt; 
      &lt;input type="text" name="q"&gt;
      &lt;input type="submit" value="Submit"&gt;
  &lt;/form&gt;
  
  {% if query %}
      Query: {{query}} &lt;br/&gt;
  {% endif %}
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>And in view.py:</p>
  
  <pre><code>def xss1(request):
      if 'q' in request.GET:
          q = request.GET['q'] 
          return render(request, 'xss_form.html', {'query': q})
      return render(request, 'xss_form.html')
  </code></pre>
  
  <p>So does everyone know some scripts input at the textfield box, can let the browser pop out an alert box ?</p>
  
  <p>Thanks!</p>