xss.py

from flask import Flask, render_template, request, escape

app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit_form():
    username = request.form.get('username')                         #gets the input from the form
    if not username or not username.isalnum():                      #checks if the input is empty or contains
        return "Invalid Username"                                   #characters that arent letters or numbers

    safe_username = escape(username)                                #encodes the username for output

    return render_template('result.html', username=safe_username)   #returns a template with a safe output

if __name__ == '__main__':
    app.run(debug=True)