Skip to content

Commit c56c5ec

Browse files
authored
Docs: Fix escaping in HTML escaping example (#5742)
2 parents 7fea7cf + 0f83958 commit c56c5ec

File tree

1 file changed

+6
-8
lines changed

1 file changed

+6
-8
lines changed

docs/quickstart.rst

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -139,18 +139,16 @@ how you're using untrusted data.
139139

140140
.. code-block:: python
141141
142+
from flask import request
142143
from markupsafe import escape
143144
144-
@app.route("/<name>")
145-
def hello(name):
145+
@app.route("/hello")
146+
def hello():
147+
name = request.args.get("name", "Flask")
146148
return f"Hello, {escape(name)}!"
147149
148-
If a user managed to submit the name ``<script>alert("bad")</script>``,
149-
escaping causes it to be rendered as text, rather than running the
150-
script in the user's browser.
151-
152-
``<name>`` in the route captures a value from the URL and passes it to
153-
the view function. These variable rules are explained below.
150+
If a user submits ``/hello?name=<script>alert("bad")</script>``, escaping causes
151+
it to be rendered as text, rather than running the script in the user's browser.
154152

155153

156154
Routing

0 commit comments

Comments
 (0)