# User input validation

**URL:** https://meta.discourse.org/t/user-input-validation/172741
**Category:** Development
**Created:** [December 9, 2020, 12:16pm UTC](https://meta.discourse.org/t/user-input-validation/172741 "2020-12-09T12:16:15Z")
**Posts on this page:** 1
**Showing post:** 10

<div class="post-metadata">

### Author: ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [December 9, 2020, 3:25pm UTC](https://meta.discourse.org/t/user-input-validation/172741/10 "2020-12-09T15:25:10Z")

</div>

Welcome to Meta @Cal 👋

> [@Cal](#):
>
> User Creation: name, title, location, bio\_raw
> 
> user fields: name, description

Those fields are sanitized/escaped. Plus, Discourse has [CSP](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243) enabled by default.

> [@Cal](#):
>
> Badges: name, description, long\_description

Those are also sanitized. They’re also only accessible to admins, and there’s also CSP.

If you’ve found a user-input security issue that happens with CSP on, we’d love to hear about it [here](https://hackerone.com/discourse?type=team).

---

_[View the full topic](https://meta.discourse.org/t/user-input-validation/172741)._