Which encoding method should be used to safely display user input in HTML content?

Question

Options

• AURL encoding
• BBase64 encoding
• CHTML entity encoding
• DHex encoding

• A
  4% (2)
• B
  9% (5)
• C
  72% (41)
• D
  16% (9)

Explanation

HTML entity encoding (option C) converts special characters like <, >, ", and & into their safe HTML equivalents (<, >, ", &), preventing browsers from interpreting user input as executable markup - the core defense against Cross-Site Scripting (XSS) attacks.

URL encoding (A) is designed for query strings and URI components, not HTML content; it encodes spaces and special chars for URLs but won't neutralize HTML tags. Base64 (B) is a binary-to-text encoding used for data transport - it has no concept of HTML context and can actually be decoded and executed by an attacker. Hex encoding (D) is used for binary data representation and has no special meaning to an HTML parser.

Memory tip: Think "HTML output → HTML encoding." Match the encoding to the context where data lands - HTML content requires HTML entity encoding, URLs require URL encoding. Mismatching context and encoding is the root cause of most injection vulnerabilities.

No community discussion yet for this question.