Frontend & browser·Browser security
the angle brackets in the comment showed up as text on the page instead of becoming a tag.
Output escaping
Also calledcontextual escaping, encoding
Encoding data so it is interpreted as content rather than as markup, script or a style, at the point it is inserted. It is context-dependent: the correct escaping for HTML text, an attribute value, a URL and a script block are all different, which is why one general-purpose escape function is not enough. Frameworks escape by default in templates, which is why almost every XSS in a modern codebase is at an explicit escape hatch.