HTMLescaped

HTMLescaped is a term used to describe text that has been transformed so that it can be safely embedded in HTML. The process, often called HTML escaping, replaces characters with character entity references that have special meaning in HTML, preventing the text from being interpreted as markup.

Common escaped sequences include &lt; for <, &gt; for >, &amp; for &, &quot; for ", and &#39; for a single quote. In addition, other named or numeric entities can be used to represent non-ASCII characters, but escaping focuses on characters with HTML syntax significance.

Escaping is context-sensitive. In ordinary text inside HTML body, the characters <, >, &, and quotes should be escaped. In attribute values, quotes and certain characters also require escaping. In JavaScript, CSS, or URL contexts, separate escaping or encoding rules apply, so the escaping must match the specific context.

HTML escaping helps prevent cross-site scripting by ensuring user-supplied content cannot be interpreted as HTML or script. However, escaping is one part of broader input sanitization and output encoding practices; untrusted input should be validated and sanitized, and outputs should be encoded according to their rendering context.

Many programming languages and frameworks include built-in escaping functions or libraries, such as Python's html.escape, PHP's htmlspecialchars, or template engines that perform automatic HTML escaping. Understanding when and how to escape is a core component of secure web development.