Output encoding and XSS prevention

Keep pages from running untrusted content as scripts.

📖 Key ideas

Cross-Site Scripting (XSS) risks arise when untrusted data is rendered as HTML/JS.
Encode output for its context (HTML, attribute, URL, JavaScript).
Modern frameworks (React, Angular, Vue) escape by default; avoid bypassing it.
Sanitise rich text with a vetted library (e.g. DOMPurify).
Add a Content Security Policy (CSP) as an extra layer.

💡 Real-life example: Output encoding is putting user text behind glass in a display case: people can read it, but it cannot act.

XSSCross-Site Scripting

Output encodingEscaping data for its context

SanitiserRemoves unsafe HTML

CSPContent Security Policy header