Software Securityhome
Fix a findingSearch
Glossary

Output encoding

Converting data into a safe form for the exact context it is written into, such as HTML entity encoding for element text or JavaScript string escaping inside a script, so the interpreter treats it as data. Encoding for the wrong context leaves the injection open.

Also called
output escaping · contextual output encoding · contextual encoding

Covered in

Guide

Prevent XSS at the output boundary

Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.

Practice: XSS lab: Render a model’s answer as text instead of active markup · HTML sanitization lab: Configure a sanitizer for user comments

Find your next answer

Type to search. Search runs in your browser.

Searches run in your browser, but the host can infer them from the index files they load. The address shows your search so you can bookmark or share it.