Preventing cross-site scripting by output encoding

Goal

Ensure that user-controlled text is always displayed as text and never interpreted as markup or script, in every context of a page.

Prerequisites

A templating engine with automatic HTML escaping and a list of the places where untrusted data reaches HTML, attributes, scripts, URLs or CSS.

Steps

1. Render pages with a template engine whose auto-escaping is on; treat any |safe or raw insertion as a review item with a justification.
2. Encode per context, as the OWASP cheat sheet prescribes: HTML entity encoding for element content and quoted attributes; URL encoding for URL components; JSON encoding with < escaped for data inside <script type="application/json"> or JSON-LD blocks; avoid inserting data into JavaScript code or CSS at all.
3. Allow only safe URL schemes (https, http, relative) for user-supplied links; reject javascript: and data:.
4. Sanitise rich text with an allow-list sanitiser if HTML input must be accepted; prefer a restricted Markdown renderer with raw HTML disabled.
5. Deploy a strict Content Security Policy so that a missed context does not execute.
6. Keep regression tests with payloads for each context.

Expected result

Payloads such as <script>, onerror= attributes and javascript: links appear literally on the page and never run; the CSP report log stays quiet.

Limits and test basis

Encoding protects rendering, not storage or other consumers of the data (emails, PDFs) which need their own encoding. DOM-based XSS in client-side scripts needs the same discipline in JavaScript. Guidance follows the cited cheat sheet.