HTML escaping
HTML escaping transforms characters with special meaning in HTML into representations treated as literal text rather than markup or executable code.
ASP.NET Core in Action, 3e
HTML encoding is the transformation of characters in text into representations that browsers treat as literal content rather than markup or executable code.
- How it is used
- Protects Razor-rendered pages by displaying dynamic text literally instead of allowing it to become HTML or executable script.
- How deep it goes
- Explains automatic Razor encoding, Html.Raw risks, JavaScript encoding differences, and Tag Helper output APIs.
- Examples
- Uses a task containing <strong> markup, injected script tags, JavaScript variables, and a SystemInfoTagHelper.
- What you can do after
- Apply it via Razor’s default output encoding and safe Tag Helper APIs while recognizing when raw output creates an XSS vulnerability.
Read how ASP.NET Core in Action, 3e explains HTML escaping →
Learn Go with Pocket-Sized Projects
HTML escaping transforms characters with special meaning in HTML into safe representations that are treated as text rather than markup or code.
- How it is used
- Uses automatic escaping when templates render dynamic values inside HTML documents.
- How deep it goes
- Explains automatic escaping and injection prevention, but does not detail escaping algorithms or context-specific rules.
- Examples
- Demonstrates rendering a variable and protecting values such as "</html>" or malicious JavaScript.
- What you can do after
- Apply it via Go’s html/template library when generating HTML containing dynamic or untrusted values.
Read how Learn Go with Pocket-Sized Projects explains HTML escaping →
Django in Action
HTML escaping replaces characters with special meaning in HTML with representations that are displayed as text rather than interpreted as markup.
- How it is used
- Protects rendered template data from being interpreted as HTML while preserving its intended text.
- How deep it goes
- Demonstrates escaping through template files, Django’s rendering engine, REPL output, and explicit safe-markup overrides.
- Examples
- Uses instrument names, greater-than signs, bold tags, the safe filter, mark_safe(), and format_html() as concrete tests.
- What you can do after
- Evaluate auto-escaping with Django’s REPL and distinguish text output from intentionally rendered safe markup.
Related concepts
- Rawcontrasts with · Raw is a Razor HTML helper method that outputs content without applying HTML encoding.
- Razor compilerused by · The Razor compiler transforms Razor files containing markup and code into generated classes or output for execution by an ASP.NET Core application.
- Razor Pagesused by · Razor Pages is an ASP.NET Core page-focused programming model in which independently addressable pages combine Razor markup with request-handling logic.
- Razor syntaxused by · Razor syntax is a templating syntax that combines markup with embedded .NET code and directives to generate web content.
- cross-site scripting attackaddresses · Cross-site scripting is a web security vulnerability in which attacker-controlled content causes executable script to run in another user’s browser within a trusted application context.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.