To protect against injection attacks, any user-provided values rendered in the output must be enclosed when returning HTML (the default response type in Flask). This will be done automatically using HTML templates produced with Jinja. The escape() function, which is seen below, can be used manually. Most examples remove it for brevity's sake, but you should constantly be conscious of how you're employing untrustworthy data. from markupsafe import escape[Text Wrapping Break][Text Wrapping Break]@app.route("/")[Text Wrapping Break]def hello(name):[Text Wrapping Break]    return f"Hello, {escape(name)}!" If a user enters the name , it is rendered as text rather than running the script in the user's browser due to escaping.