This depends entirely on what you do with the input from the webform. In normal use the form gets encoded as x-www-form-urlencoded or json -- Both formats which can be deserialized into a python dictionary completely safely. Of course, they could be deserialized in unsafe ways too -- Make sure that you use libraries that are dedicated to handling this properly (e.g. urlparse or json).

From there, whether the input is safe depends entirely on what the application does with it. (e.g. it is not safe if the application uses eval with input based on the decoded dict).

As for automated testing for this -- I don't know of any way to accomplish this, but these problems are generally pretty easy to mitigate by just following normal best-practices (don't eval code you don't trust, etc. etc.)

Using eval is not a good way to process JSON:

1. JSON isn't even valid Python, because of true, false, and null.

2. eval will execute arbitrary Python code, so you are at the mercy of malicious injection of code.

Use the json module available in the standard library instead:

import json
data = json.loads("[1, 2, 3]")

If you're using a version of Python older than 2.6, you'll need to download the module yourself. It's called simplejson and can be downloaded from PyPi.

Don't eval(); JSON is not Python even if they look a lot alike. Use the json module to parse it:

import json

with open('text.json') as f:
    obj = json.load(f)

This uses json.load() to load the JSON data from an open file object. If you have a string containing the JSON data use json.loads() (note the s).

Since the strings passed to eval are constant, with nothing substituted into them, this code is safe. However, it's also a pointless deviation from best practices: There's no legitimate reason to use eval here at all.

Assuming that you want to be able to do operations other than re.sub(), one approach is to use lambdas:

from re import sub

input = request.POST['input']
sub_pattern = {'1': lambda input: sub('pattern1','txt1',input),
               '2': lambda input: sub('pattern2','txt2',input)}
sub_pattern'1'

You'd be better of using getattr():

if instruction and "INSTRUCTION" in instruction:
    instr_callable = getattr(self, 'do_' + instruction['INSTRUCTION'], None)
    if instr_callable is not None:
        instr_callable()

where do_ is prefixed to the instruction name to ensure that only allowed methods are called through this method.

If your instruction functions live in the global namespace, use globals() instead, and use it as a mapping:

if instruction and "INSTRUCTION" in instruction:
    instr_callable = globals().get('do_' + instruction['INSTRUCTION'], None)
    if instr_callable is not None:
        instr_callable(self)

However, you'd then be better of putting those callables in an explicit mapping:

instr_callables = dict(
    register=register,
    join=join,
    ...
)

if instruction and "INSTRUCTION" in instruction:
    instr_callable = instr_callables.get(instruction['INSTRUCTION'], None)
    if instr_callable is not None:
        instr_callable(self)

eval() is rarely, if ever, needed to look up arbitrary objects in python namespaces.