Change app.py

content/app.py

@@ -1,4 +1,4 @@
-from flask import Flask, request, redirect, make_response
+from flask import Flask, request, redirect, make_response, escape
 import sqlite3
 import urllib
 import quoter_templates as templates
@@ -14,10 +14,10 @@
 db.row_factory = sqlite3.Row
 
 # Log all requests for analytics purposes
-log_file = open('access.log', 'a', buffering=1)
 @app.before_request
 def log_request():
-    log_file.write(f"{request.method} {request.path} {dict(request.form) if request.form else ''}\n")
+    with open('access.log', 'a', buffering=1) as log_file:
+        log_file.write(f"{request.method} {request.path} {dict(request.form) if request.form else ''}\n")
 
 # Set user_id on request if user is logged in, or else set it to None.
 @app.before_request
@@ -32,7 +32,9 @@ def check_authentication():
 @app.route("/")
 def index():
     quotes = db.execute("select id, text, attribution from quotes order by id").fetchall()
-    return templates.main_page(quotes, request.user_id, request.args.get('error'))
+    error_message = escape(request.args.get('error', ''))
+    return templates.main_page(quotes, request.user_id, error_message)
+
 
 
 # The quote comments page