GUIDE深度 · Deep dive
HTML Escaping and XSS
XSS happens when user input is executed as HTML or JavaScript. Escaping rules differ for HTML text, attributes, URLs and JS contexts; the safest approach is framework auto-escaping instead of hand-built HTML.
Escape by context
HTML text: & < >; attributes also need quotes.
URL parameters: percent-encoding; JS strings: JSON encoding/escaping.
Do not escape once globally
Escaping before concatenation can be decoded again; escape at the final output context.
Rich text needs an allowlist sanitizer, not simple entity encoding.
FAQ
Does entity encoding stop SQL injection?
No; use parameterized queries for SQL.
Is client-side escaping enough?
No; server-side context handling is also required.