How does a website post client-side scripting code examples without getting executed on client machine? [duplicate]

Question

I am studying Security and wanted to know the general approach to retrieve and display code to client after it is safely encoded and stored in the database.

< for < and > for > can display <script> normally with < and > — Subin
– Subin, Commented Mar 1, 2014 at 7:40

Subin · Accepted Answer · 2014-03-01 07:56:30Z

0

The following code is JS that will alert Hello :

<script>
 alert('Hello');
</script>

The above code can be displayed on a web page by replacing the < with < and > with &gt :

&lt;script&gt;
 alert('Hello');
&lt;/script&gt;

The above will display as code, but won't execute on client side.

edited Mar 1, 2014 at 7:56

answered Mar 1, 2014 at 7:48

Subin

3,5731 gold badge36 silver badges65 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2023-11-17 19:48:52Z

0

Output using:

htmlspecialchars($output, ENT_QUOTES, 'UTF-8');

If you are using a framework or template engine, they will inevitably have some sort of escape function or modifier to use from within a template which wraps this function.

See: https://www.php.net/htmlspecialchars

edited Nov 17, 2023 at 19:48

CommunityBot

11 silver badge

answered Mar 1, 2014 at 21:32

Pádraic Brady

11 bronze badge

Collectives™ on Stack Overflow

How does a website post client-side scripting code examples without getting executed on client machine? [duplicate]

2 Answers 2

Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Linked

Related