Hacker News Reader

Fixed. Let me know if we missed anything.

I wish we could use Django's autoescape filter but App Engine's SDK ships with just 0.96 by default.

We can only upgrade to a later version of Django in Prod and not locally.

You really need to use Django-nonrel, it's at 1.3b and awesome. I use it for http://www.yourpane.com and it works fantastically well.

Usernames aren't sanitized yet. (As is visible with the '<asdf' in the 'foobar' link above.)

EG: http://profile.io/xss2

Also, you missed the login form (both in the header and on http://profile.io/login). Its echoing the username directly, e.g., "Username <script>alert(1)</script> was not found"

Reply on news.ycombinator.com