Add a proper user input validation and sanitization.

[OhmSpectator]

The application uses the escape() function to escape user input before storing it in the at_home dictionary. However, this function is intended for escaping HTML content and may not be sufficient to prevent injection attacks or other types of tampering with the input data. It is generally a good practice to use more robust input validation and sanitization techniques to prevent such attacks.

[OhmSpectator]

Use the wtforms lib.

For example:

from flask import Flask, request, render_template
from wtforms import Form, fields

class MyForm(Form):
    interval_start = fields.DateField(format='%Y-%m-%d')
    interval_end = fields.DateField(format='%Y-%m-%d')

app = Flask(__name__)

@app.route('/', methods=['GET', 'POST'])
def index():
    form = MyForm(request.form)
    if request.method == 'POST' and form.validate():
        interval_start = form.interval_start.data
        interval_end = form.interval_end.data
        # ... do something with the dates here ...
    return render_template('index.html', form=form)

<form method="POST" action="/">
    {{ form.csrf_token }}
    {{ form.interval_start.label }} {{ form.interval_start(size=10) }}
    {{ form.interval_end.label }} {{ form.interval_end(size=10) }}
    <input type="submit" value="Submit">
</form>

[OhmSpectator]

https://python-adv-web-apps.readthedocs.io/en/latest/flask_forms.html