Sanitizing HTML in submitted form data

Question

Is there a generic "form sanitizer" that I can use to ensure all html/scripting is stripped off the submitted form? form.clean() doesn't seem to do any of that - html tags are all still in cleaned_data. Or actually doing this all manually (and override the clean() method for the form) is my only option?

Related: http://stackoverflow.com/q/699468/212218 – Feb 21 '13 at 13:28 — , Feb 21 '13 at 13:28

score 55 · Answer 1 · edited Apr 06 '21 at 13:36

55

strip_tags actually removes the tags from the input, which may not be what you want.

To convert a string to a "safe string" with angle brackets, ampersands and quotes converted to the corresponding HTML entities, you can use the escape filter:

from django.utils.html import escape
message = escape(form.cleaned_data['message'])

edited Apr 06 '21 at 13:36

djvg

11,722
5
72
103

answered Aug 23 '11 at 10:53

simao

14,491
9
55
66

score 36 · Accepted Answer · answered Apr 12 '11 at 22:03

36

Django comes with a template filter called striptags, which you can use in a template:

value|striptags

It uses the function strip_tags which lives in django.utils.html. You can utilize it also to clean your form data:

from django.utils.html import strip_tags
message = strip_tags(form.cleaned_data['message'])

answered Apr 12 '11 at 22:03

Bernhard Vallant

49,468
20
120
148

6

"Note that strip_tags result may still contain unsafe HTML content, so you might use escape() to make it a safe string." - https://docs.djangoproject.com/en/dev/ref/utils/#django.utils.html.strip_tags – Collin Anderson Jan 22 '14 at 22:22
Strip_tags() alone is insufficient, and the strip_tags() + escape() combination makes for really ugly text-- especially where it legitimately contains apostrophes. Just use bleach.clean(). – Ivan May 28 '17 at 00:38
3

Is there any reason to strip tags? If a user is submitting tag like stuff it is probably better to escape it but keep it looking like the input. Say I enter stuff like `bad joke` – AnnanFay Feb 14 '18 at 05:26

score 35 · Answer 3 · edited Jun 20 '20 at 09:12

Alternatively, there is a Python library called bleach:

Bleach is a whitelist-based HTML sanitization and text linkification library. It is designed to take untrusted user input with some HTML.

Because Bleach uses html5lib to parse document fragments the same way browsers do, it is extremely resilient to unknown attacks, much more so than regular-expression-based sanitizers.

Example:

import bleach
message = bleach.clean(form.cleaned_data['message'], 
                       tags=ALLOWED_TAGS,
                       attributes=ALLOWED_ATTRIBUTES, 
                       styles=ALLOWED_STYLES, 
                       strip=False, strip_comments=True)

Sanitizing HTML in submitted form data

3 Answers3

Linked

Related