From 85f6394855ab44f38f7c1be1a237d56578e3b554 Mon Sep 17 00:00:00 2001
From: Brian Minsk <brianminsk@users.noreply.github.com>
Date: Thu, 12 Mar 2020 21:25:11 +0700
Subject: [PATCH] sanitized user input with html.escape

---
 main.py | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/main.py b/main.py
index fd03988..f07ffe4 100644
--- a/main.py
+++ b/main.py
@@ -1,5 +1,6 @@
 import os
 import base64
+import html
 
 from flask import Flask, request
 from model import Message 
@@ -22,7 +23,6 @@ def home():
     <textarea name="content"></textarea>
     <input type="submit" value="Submit">
 </form>
-
 <h2>Wisdom From Your Fellow Classmates</h2>
 """
     
@@ -31,12 +31,11 @@ def home():
 <div class="message">
 {}
 </div>
-""".format(m.content)
+""".format(html.escape(m.content))
 
     return body 
 
 
 if __name__ == "__main__":
     port = int(os.environ.get("PORT", 6738))
-    app.run(host='0.0.0.0', port=port)
-
+    app.run(host='0.0.0.0', port=port)
\ No newline at end of file