Sanitize input for code blog

Question

I have a code blog in which I have a user input form for submissions. Whatever goes in that form will appear on one of the pages. Now this is a coding blog, so I don't want to strip any HTML tags or javascript code from the input, but I don't want it to executed at any point. What is the best way to render any input harmless? Is replacing < by < and > by > enough?

(for info, the sever will be GAE, the input will be passed around (but never evaluated) in python variables, and stored in a TextProperty)

Answer 1

Yes, replacing < and > should be enough

Answer 2

The best bet would be to simply escape those values on the back-end for safe input into your storage engine and output them using HTML entities so that they are displayed as code.