One value, four sinks — pick an escaper

The same user input lands in four places at once. Choose an escaper and read why each sink is safe or still runs code. ✖ EXECUTES, ▲ BROKEN and ✔ SAFE are three different outcomes.

User input (the name field)

Escaper applied to the value

none HTML entity (& < >) attribute: quote + entity JS string (backslash) URL encode (%xx)

After escaping, the one value every sink receives:

One value, four sinks — pick an escaper

1 · HTML text node

2 · Unquoted attribute

3 · Inside href="…"

4 · JS string in <script>