As a rule of thumb, you should always encode HTML entities, such as the < and > characters, when they come from untrusted sources. To escape URIs and JavaScript code, you can use free escaping/encoding tools such as the JavaScript String Escaper and URL Encoder/Decoder by FreeFormatter.
- 0 replies
- 0 recasts
- 1 reaction
While encoding adds an extra character before a potentially dangerous character, such as the \ character before the quotation mark in JavaScript, escaping converts a character into an equivalent but safe format, for instance the > character into the > string in HTML.
- 0 replies
- 0 recasts
- 0 reactions
Escape or encode user input To avoid XSS attacks, it’s also important to escape or encode incoming or unsafe data. Escaping and encoding are two technologies that convert special characters that can pose a security risk into a safe form.
- 0 replies
- 0 recasts
- 0 reactions