title: XSS Protection using golang
body: <p>I'm following this <a href="https://astaxie.gitbooks.io/build-web-application-with-golang/content/en/04.3.html" rel="nofollow noreferrer">tutorial</a> for golang.</p>
  <p>I don't really understand where should I put this code inside of my code</p>
  <pre><code>t, err := template.New(&quot;foo&quot;).Parse(`{{define &quot;T&quot;}}Hello, {{.}}!{{end}}`)
  err = t.ExecuteTemplate(out, &quot;T&quot;, &quot;&lt;script&gt;alert('you have been pwned')&lt;/script&gt;&quot;)
  </code></pre>
  <p>following is my main.go</p>
  <pre><code>package main
  
  import (
      &quot;fmt&quot;
      //&quot;html/template&quot;
      &quot;log&quot;
      &quot;net/http&quot;
      &quot;strings&quot;
      &quot;text/template&quot;
  )
  
  func sayhelloName(w http.ResponseWriter, r *http.Request) {
      r.ParseForm() //Parse url parameters passed, then parse the response packet for the POST body (request body)
      // attention: If you do not call ParseForm method, the following data can not be obtained form
      fmt.Println(r.Form) // print information on server side.
      fmt.Println(&quot;path&quot;, r.URL.Path)
      fmt.Println(&quot;scheme&quot;, r.URL.Scheme)
      fmt.Println(r.Form[&quot;url_long&quot;])
      for k, v := range r.Form {
          fmt.Println(&quot;key:&quot;, k)
          fmt.Println(&quot;val:&quot;, strings.Join(v, &quot;&quot;))
      }
      fmt.Fprintf(w, &quot;Hello astaxie!&quot;) // write data to response
  }
  
  func login(w http.ResponseWriter, r *http.Request) {
      fmt.Println(&quot;method:&quot;, r.Method) //get request method
      if r.Method == &quot;GET&quot; {
          t, _ := template.ParseFiles(&quot;login.gtpl&quot;)
          t.Execute(w, nil)
      } else {
          r.ParseForm()
          // logic part of log in
          fmt.Println(&quot;username:&quot;, r.Form[&quot;username&quot;])
          fmt.Println(&quot;password:&quot;, r.Form[&quot;password&quot;])
          
          //I put the sample code here
          t, err := template.New(&quot;foo&quot;).Parse(`{{define &quot;T&quot;}}Hello, {{.}}!{{end}}`)
          err = t.ExecuteTemplate(out, &quot;T&quot;, &quot;&lt;script&gt;alert('you have been pwned')&lt;/script&gt;&quot;)
      }
  }
  
  func main() {
      http.HandleFunc(&quot;/&quot;, sayhelloName) // setting router rule
      http.HandleFunc(&quot;/login&quot;, login)
      err := http.ListenAndServe(&quot;:9090&quot;, nil) // setting listening port
      if err != nil {
          log.Fatal(&quot;ListenAndServe: &quot;, err)
      }
  }
  </code></pre>
  <p>After I put the sample code in func login and compile, it wants out to &quot;out&quot; undefined on this line</p>
  <pre><code>err = t.ExecuteTemplate(out, &quot;T&quot;, &quot;&lt;script&gt;alert('you have been pwned')&lt;/script&gt;&quot;)
  </code></pre>
  <p>Can anyone help me to figure out the problem?
  thanks</p>