title: Is possible to write XSS vulnerable flask web app?
body: <p>I'm trying to write a stored xss vulnerable flask web app. My app receive input via this input field <code>&lt;input type=&quot;text&quot; name=&quot;content&quot; id=&quot;content&quot; /&gt;</code> and then show User input into an HTML table.
  I tried to insert a script like <code>&lt;script&gt;alert(1)&lt;/script&gt;</code> into the input field but when it is shown, the script isn't triggered.<br />
  Here is my code:<br />
  <strong>app.py</strong></p>
  <pre><code>from flask import Flask, render_template, request, redirect
  from flask_sqlalchemy import SQLAlchemy
  from datetime import datetime
  
  
  app = Flask(__name__)
  app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///test.db'
  db = SQLAlchemy(app)
  
  class Todo(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    content = db.Column(db.String(200), nullable=False)
    date_created = db.Column(db.DateTime, default=datetime.utcnow)
  
    def __repr__(self):
      return '&lt;Task %r&gt;' % self.id
  
  @app.route('/', methods = ['POST', 'GET'])
  def index():
    if request.method == 'POST':
      task_content = request.form['content']
      new_task = Todo(content=task_content)
      try:
        db.session.add(new_task)
        db.session.commit()
        return redirect('/')
      except:
        return &quot;There was an issue adding your task&quot;
    else:
      tasks = Todo.query.order_by(Todo.date_created).all()
      return render_template(&quot;index.html&quot;, tasks=tasks)
  
  if __name__ == &quot;__main__&quot;:
    app.run(debug=True)
  </code></pre>
  <p><strong>index.html</strong></p>
  <pre><code>{% extends 'base.html' %} 
  {% block head %}
  &lt;title&gt;Task Master&lt;/title&gt;
  {% endblock %}
  {% block body %}
  &lt;div class=&quot;content&quot;&gt;
    &lt;h1 style=&quot;text-align: center&quot;&gt;Task Master&lt;/h1&gt;
    {% if tasks|length &lt; 1 %}
    &lt;h4 style=&quot;text-align: center&quot;&gt;There are no tasks. Create one below!&lt;/h4&gt;
    {% else %}
    &lt;table&gt;
      &lt;tr&gt;
        &lt;th&gt;Task&lt;/th&gt;
        &lt;th&gt;Added&lt;/th&gt;
        &lt;th&gt;Actions&lt;/th&gt;
      &lt;/tr&gt;
      {% for task in tasks %}
      &lt;tr&gt;
        &lt;td&gt;{{ task.content }}&lt;/td&gt;
        &lt;td&gt;{{ task.date_created.date() }}&lt;/td&gt;
        &lt;td&gt;
          &lt;a href=&quot;/delete/{{task.id}}&quot;&gt;Delete&lt;/a&gt;
          &lt;br /&gt;
          &lt;a href=&quot;/update/{{task.id}}&quot;&gt;Update&lt;/a&gt;
        &lt;/td&gt;
      &lt;/tr&gt;
      {% endfor %}
    &lt;/table&gt;
    {% endif %}
  
    &lt;div class=&quot;form&quot;&gt;
      &lt;form action=&quot;/&quot; method=&quot;POST&quot;&gt;
        &lt;input type=&quot;text&quot; name=&quot;content&quot; id=&quot;content&quot; /&gt;
        &lt;input type=&quot;submit&quot; value=&quot;Add Task&quot; /&gt;
      &lt;/form&gt;
    &lt;/div&gt;
  &lt;/div&gt;
  {% endblock %}
  </code></pre>
  <p><strong>base.html</strong></p>
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html lang=&quot;en&quot;&gt;
    &lt;head&gt;
      &lt;meta charset=&quot;UTF-8&quot; &gt;
      &lt;meta http-equiv=&quot;X-UA-Compatible&quot; content=&quot;IE=edge&quot; &gt;
      &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot; &gt;
      &lt;link
        rel=&quot;stylesheet&quot;
        href=&quot;{{ url_for('static', filename='css/main.css') }}&quot;
      &gt;
      {% block head %}{% endblock %}
    &lt;/head&gt;
    &lt;body&gt;
      {% block body %}{% endblock %}
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  <p>I follow <a href="https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbVlkWml6LXdidjlTMFdZb1FKMGFHb25iRDlLQXxBQ3Jtc0tsNlBtLUdmeHNxbHZLN0ZlSXJDZUlQQU5BdTl5ZWFfSU55N3Nob1ZXRmJNNlFvMkpKUFFKNTdfeE9zRFczX1Rxajhmbm16b0M4bVd2LUdubVUwNUZMWklMdHoyTjJRbTA2WFVxSVF6THVPdmd0Q1N0dw&q=https%3A%2F%2Fgithub.com%2Fjakerieger%2FFlaskIntroduction" rel="nofollow noreferrer">this</a> example.<br/>
  This is a screen of the form:<br/>(<a href="https://i.stack.imgur.com/870tY.png" rel="nofollow noreferrer">https://i.stack.imgur.com/870tY.png</a>)<br/>
  and this is a screen of the HTML after the script submission:<br/>(<a href="https://i.stack.imgur.com/U1Jdd.png" rel="nofollow noreferrer">https://i.stack.imgur.com/U1Jdd.png</a>)<br/><br/>
  How do I make the script executable when the page is loaded?</p>