Please use django forms. There could be anything in the post-data. This looks like a security hole.