Vfrdtyky

My understanding is that Django has great default settings to minimize the risk that there is client size XSS attack, for example if you had <p>Hello {{ user.username }}</p> in your template, where the user could type in anything they want for their username.

I don't see any references to XSS in client side Python files. Is my understanding correct that there is no major concern for a client side XSS attack?

As an example situation, the user can input anything they want into an input box. The results from that input box are stored in a database. That input is then queried from a database and sent in an email.

email = EmailMessage(
ExtendedUser.objects.filter(user__username=username)[0].email_subject,
ExtendedUser.objects.filter(user__username=username)[0].email_content,
'me@mysite.com',
['me@mysite.com']
)
email.content_subtype = "html"
email.send()


In situations like this, is there any need to strip any tags or sanitize anything anything? I'm not sure when I need to be concerned about malicious user inputted data.

EDIT: I know Django project writes "XSS attacks allow a user to inject client side scripts into the browsers of other users." I'm interested if there are any client side reasons to strip user inputted data of malicious tags.

You should look into the documentation for {%csrft token%} tag