Software developers should escape all characters (including spaces but excluding alphanumeric characters) with the HTML entity &#xHH; format to prevent what type of attack?

DDoS attacks flood a target with traffic to exhaust resources and are not affected by how user input is encoded in web applications.

XSS attacks inject malicious scripts into web content viewed by other users by exploiting unescaped user input. Encoding all non-alphanumeric characters as HTML entities (&#xHH;) ensures browsers treat the input as literal text rather than HTML or JavaScript, directly blocking the injection vector XSS relies on.

CSRF attacks trick authenticated users into submitting forged requests and are mitigated by anti-CSRF tokens or SameSite cookie attributes, not by HTML entity encoding.

Brute-force attacks repeatedly guess credentials and are countered by rate limiting or account lockout policies, not by input encoding.