Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Should I escape numbers in django to prevent XSS attacks ? The numbers are stored in db and of "decimal,float,..." type. Should I escape these values or is it useless to prevent XSS attacks ?

share|improve this question
up vote 3 down vote accepted

I'm not sure how you would be able to do XSS based purely on numeric values. However a good approach is to always escape input variables and check them for type. For instance if a user is required to input a number, he might also insert a string which could cause an exception in your program. This is somthing you need to take into account. Note that client side validation is useless (so checking with javascript or a dropdown list with only numbers is not going to help you perform secure input validation).

so in python you can do:

    "do database logic"
    print "not valid."
share|improve this answer
are python and django type validation enough ? – maazza May 31 '13 at 7:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.