SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-xss-context-encoding

Why must XSS output encoding match the browser context?

Browsers parse HTML, JavaScript, URLs, and CSS differently.

Start playing free

  1. Every context uses SQL
  2. Encoding changes screen size
  3. Each context has different syntax ✔

Why: An encoder safe for ordinary HTML text may be wrong inside JavaScript, CSS, a URL, or an attribute. Context-aware encoding stops untrusted text from becoming executable syntax.

Huh, didn't know that: When users intentionally author HTML, sanitization is needed instead of displaying it as encoded text.

The dad joke
HTML and JavaScript argued because each wanted its own escape plan.
Like this card?
Play the game

References

Answer: Each context has different syntax. An encoder safe for ordinary HTML text may be wrong inside JavaScript, CSS, a URL, or an attribute. Context-aware encoding stops untrusted text from becoming executable syntax.

  1. OWASP Cross Site Scripting Prevention Cheat Sheet cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
    browsers parse HTML, JS, URLs, and CSS differently
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyHow do parameterized queries block SQL injection?Security & PrivacyWhich three goals form the CIA triad?Security & PrivacyWhich password property most directly increases resistance to guessing?

That's stuff everyone should know.