Sanitise User Input for HTML Output
Encode user-provided strings before inserting them into HTML — prevents XSS injection attacks.
Common HTML entities reference
Security tips
Paste any user input here to see exactly which characters get encoded. < becomes <, > becomes >, & becomes & — all rendered as text, not HTML.
Cross-Site Scripting (XSS) attacks inject <script> tags via user input fields. Encoding all user output is the primary defense.
Always encode on output (when rendering), not on input (when saving). Store raw data, encode when displaying — this avoids double-encoding bugs.
Test with payloads like <script>alert(1)</script> and onmouseover="alert(1)" to verify your encoding catches all attack vectors.
یہ کیسے کام کرتا ہے
ہمارا کیوں؟
Also check out…
Encode Content for RSS Feeds
Encode HTML content for RSS feed item descriptions
Encode Special Characters for HTML Email
Encode characters like &, <, >, and © as HTML enti
Encode User Content for Web Display
Prevent XSS attacks by encoding user-generated con
Encode Content for XML
Encode special characters for XML files, RSS feeds