Output Encoding

Output encoding converts potentially dangerous characters into safe representations before rendering data in a specific context — HTML encoding for HTML output, JavaScript encoding for script contexts, URL encoding for query parameters. It is the primary defense against XSS attacks by ensuring that attacker-controlled data is always treated as content, never as executable code.

Context-aware encoding is essential: the encoding needed for HTML body differs from that needed for HTML attributes or JavaScript strings.