request.form

I think you are attacking it from the wrong angle by trying to encode all posted data. Note that a “<” could also come from other outside sources, like a database field, a configuration, a file, a feed and so on. Furthermore, “<” is not inherently dangerous. It’s only dangerous in a specific context: when … Read more