Comparison
HTML sanitisationvsOutput escaping
HTML sanitisation
you needed to accept formatted text, so you parsed it and stripped everything not on the allowed list.
Parsing untrusted markup and removing anything not on an explicit allowlist of elements and attributes, for the case where you genuinely must render user HTML. It has to be allowlist-based and it has to run on a real parser, because blocklists and regexes lose to parser quirks every time. Use a maintained library or the platform's own Sanitizer API; a hand-written one is a vulnerability with a delay on it.
Full entry →Output escaping
the angle brackets in the comment showed up as text on the page instead of becoming a tag.
Encoding data so it is interpreted as content rather than as markup, script or a style, at the point it is inserted. It is context-dependent: the correct escaping for HTML text, an attribute value, a URL and a script block are all different, which is why one general-purpose escape function is not enough. Frameworks escape by default in templates, which is why almost every XSS in a modern codebase is at an explicit escape hatch.
Full entry →