How come Django allows user to enter  in form CharField without throwing an error?
It's perfectly valid input. But it won't result in an alert on the page - because Django automatically escapes output.
I am new to Django and in my Django application, I have a model that contains the basic information about a vehicle (name, model, make, year). I add the information through a form. The issue is that if the user were to enter "alert("error")" then the form will allow it and it will be saved as valid input. So when the page refreshes, there will be an alert on the page and the field will now be blank. How to I prevent the user from entering JavaScript in the CharField?
I do not have 'autoescape off' anywhere in the code base nor do I use the 'safe' keyword in the html. I do not have the 'def clean' checking for such input as I was under the impression that Django would take care of such injection. Thanks in advance!