Escape (and everything else), and check the site for XSS. I don't mean to be rude, and I realize you two coded this up in a really short amount of time -- but before this site goes live it would be best to have it secure. Demo: http://profile.io/foobar [EDIT] As someone else pointed out, viewing the list-of-developers page puts up the XSS, which is even worse. I didn't know that page existed. [EDIT2] It turns out I b…
Fixed. Let me know if we missed anything. I wish we could use Django's autoescape filter but App Engine's SDK ships with just 0.96 by default. We can only upgrade to a later version of Django in Prod and not locally.
You really need to use Django-nonrel, it's at 1.3b and awesome. I use it for http://www.yourpane.com and it works fantastically well.