Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Should I escape numbers in django to prevent XSS attacks ? The numbers are stored in db and of "decimal,float,..." type. Should I escape these values or is it useless to prevent XSS attacks ?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

I'm not sure how you would be able to do XSS based purely on numeric values. However a good approach is to always escape input variables and check them for type. For instance if a user is required to input a number, he might also insert a string which could cause an exception in your program. This is somthing you need to take into account. Note that client side validation is useless (so checking with javascript or a dropdown list with only numbers is not going to help you perform secure input validation).

so in python you can do:

   try:
    float(variable)
    "do database logic"
   except:
    print "not valid."
share|improve this answer
    
are python and django type validation enough ? –  maazza May 31 '13 at 7:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.