Secure Coding Practices

import re
import html

def validate_and_sanitize_input(user_input: str, input_type: str) -> str:
    """
    Validates and sanitizes user input based on type
    """
    if input_type == 'email':
        if not re.fullmatch(r"(^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$)", user_input):
            raise ValueError("Invalid email format")
    
    elif input_type == 'name':
        if not user_input.isalpha():
            raise ValueError("Name must contain only letters")
    
    elif input_type == 'number':
        if not user_input.isdigit():
            raise ValueError("Must be a valid number")
    
    # Sanitize by making web-safe
    return html.escape(user_input)

<!-- Test these in input boxes to check for XSS vulnerabilities -->
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)"></iframe>

from flask import Flask, request, jsonify
import html
import re

api = Flask(__name__)

def validate_form_data(data):
    """
    Comprehensive form validation
    """
    errors = []
    
    # Validate email
    email = data.get('email', '').strip()
    if not re.fullmatch(r"(^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$)", email):
        errors.append('Invalid email format')
    
    # Validate password strength
    password = data.get('password', '')
    if len(password) < 8 or len(password) > 20:
        errors.append('Password must be 8-20 characters')
    if not re.search(r'[A-Z]', password):
        errors.append('Password must contain uppercase letter')
    if not re.search(r'[a-z]', password):
        errors.append('Password must contain lowercase letter')
    if not re.search(r'[0-9]', password):
        errors.append('Password must contain digit')
    if not re.search(r'[@$!%*?&]', password):
        errors.append('Password must contain special character')
    
    # Validate username
    username = data.get('username', '').strip()
    if not username.isalnum():
        errors.append('Username must be alphanumeric')
    
    return errors

@api.route('/submit_form', methods=['POST'])
def submit_form():
    try:
        data = request.get_json()
        
        # Validate input
        errors = validate_form_data(data)
        if errors:
            return jsonify({'errors': errors}), 400
        
        # Sanitize data
        safe_data = {
            'email': html.escape(data['email'].strip()),
            'username': html.escape(data['username'].strip())
        }
        
        # Process data (database operations)
        # Use parameterized queries
        # cur.execute('INSERT INTO users (email, username) VALUES (?, ?)', 
        #             (safe_data['email'], safe_data['username']))
        
        api.logger.info(f'Form submitted successfully for {safe_data["email"]}')
        return jsonify({'success': True}), 201
        
    except Exception as e:
        api.logger.error(f'Form submission error: {str(e)}')
        return jsonify({'error': 'Submission failed'}), 500