Sanitise User Input for HTML Output

Paste any user input here to see exactly which characters get encoded. < becomes &lt;, > becomes &gt;, & becomes &amp; — all rendered as text, not HTML.

Cross-Site Scripting (XSS) attacks inject <script> tags via user input fields. Encoding all user output is the primary defense.

Always encode on output (when rendering), not on input (when saving). Store raw data, encode when displaying — this avoids double-encoding bugs.

Test with payloads like <script>alert(1)</script> and onmouseover="alert(1)" to verify your encoding catches all attack vectors.