Sanitize / Escape

What it does

Two packages that solve the same problem on either side of the request. flask-sanitize-escape registers as Flask middleware and scrubs query parameters, form data, and JSON payloads before a route handler ever runs, exposing the cleaned values as g.sanitized_args, g.sanitized_form, and g.sanitized_json. vue-sanitize-escape is the client-side half: a Vue plugin with a $sanitizeEscape helper and a v-sanitize directive for inputs.

Both work by neutralising rather than rejecting. Dangerous HTML is entity-encoded, script and iframe tags and on* attributes are stripped, and regex filters catch SQL injection and open-redirect patterns. Sanitising deeply through nested objects and arrays means a payload cannot hide behind one more layer of nesting.

Why it exists

Input validation fails in the gaps. One handler sanitises, the next one added under deadline does not, and the vulnerability lives in the difference. Middleware closes the gap by making the safe behaviour the default for every route at once, including the ones nobody has written yet.

The libraries came out of building security middleware for internal Flask and Vue platforms, where the goal was to remove the per-handler decision entirely rather than document it and hope.

Using it

flask-sanitize-escape installs from PyPI and vue-sanitize-escape from npm. The Flask extension takes sanitize_quotes and custom_characters options; enabling sanitize_quotes is recommended. Both are MIT licensed and dependency-free on the client side.