Comment by danjac

This code looks like it has an XSS vulnerability in the submit() method: returning plain f-string i.e.

    return f"<tr>
        <td>{title}</td>
        <td>{author_name}</td>
        <td>...."

Probably safer (and more maintainable) to just return a Jinja2 template instead.