Sanitise User Input for HTML Output
Encode user-provided strings before inserting them into HTML — prevents XSS injection attacks.
Common HTML entities reference
Security tips
Paste any user input here to see exactly which characters get encoded. < becomes <, > becomes >, & becomes & — all rendered as text, not HTML.
Cross-Site Scripting (XSS) attacks inject <script> tags via user input fields. Encoding all user output is the primary defense.
Always encode on output (when rendering), not on input (when saving). Store raw data, encode when displaying — this avoids double-encoding bugs.
Test with payloads like <script>alert(1)</script> and onmouseover="alert(1)" to verify your encoding catches all attack vectors.
Ինչպես է այն աշխատում
Ինչու՞ օգտագործել մերը:
Also check out…
Encode Content for RSS Feeds
Encode HTML content for RSS feed item descriptions
Encode Special Characters for HTML Email
Encode characters like &, <, >, and © as HTML enti
Encode User Content for Web Display
Prevent XSS attacks by encoding user-generated con
Encode Content for XML
Encode special characters for XML files, RSS feeds