A small piece of HTML can change what a visitor sees or how the browser understands a page. In this lesson, you will explore injection through untrusted user content using a short example that you can inspect and change.
The Idea in Plain English
Escaping turns special characters into safe text when displaying untrusted input. For HTML text, an ampersand and less-than sign require particular care; attribute values also need quotes escaped when quoted.
Do not treat a browser hint or attribute as a complete security system. Server validation, HTTPS, safe rendering and appropriate response headers remain important.
A Working Example
Read the sample once before copying it. Notice the element names and attribute values, then compare them with the explanation below.
<p>To write a paragraph, type <p>Hello</p>.</p>
<p>Fish & chips are on the menu.</p>What Each Part Does
- A paragraph keeps one idea together as readable text.
- The browser reads these lines in order and uses them to build the page or request.
- Changing the relevant value lets you test what this feature controls.
A visitor sees the literal text instead of the browser interpreting it as HTML markup.
Keep the example small while learning. Once it behaves as expected, try it inside a larger page and make sure the URLs, files and surrounding HTML are correct.
Try It Yourself
Try this next: demonstrate a safe and an unsafe snippet and validate behavior focused on HTML Injection Through Untrusted User Content, including a working example and an incorrect example to correct. Then inspect the page and explain what changed.
Common Beginner Mistakes
- Building HTML using raw user input; escaping must match the exact context, such as HTML text, an attribute or a URL.
- Changing several parts of the example at once, making it difficult to see which part caused a different result.
- Choosing a tag only because its default appearance looks right, without checking whether it describes the content correctly.
Key Takeaways
- Escaping turns special characters into safe text when displaying untrusted input. For HTML text, an ampersand and less-than sign require particular care; attribute values also need quotes escaped when quoted.
- A visitor sees the literal text instead of the browser interpreting it as HTML markup.
- Test the markup in a browser, and check accessibility and real-world behavior where relevant.