Worked example
Escaping <strong>Title</strong> lets a browser display the tag source instead of rendering bold text.
Understanding settings and results
- Escaping for text display is not complete protection against cross-site scripting.
- Unescaping restores characters without executing page scripts.
Scope and limitations
- Before inserting untrusted HTML into a page, still use an established sanitizer and context-specific encoding.
- Attributes, URLs and JavaScript strings each require their own safety rules.
Troubleshooting
- If tags still render, check whether the framework unescaped the output again.
- &lt; usually means content was escaped twice.
Privacy and processing
Text is converted locally in the browser only.