Escape at the correct output boundary

Steps

Store canonical data. Apply HTML escaping at text/attribute output and URL-encode individual path segments before HTML escaping.

// HTML text context.
<?= $e($record['title']) ?>
// One URL segment inside an HTML attribute.
<a href="/items/<?= $e(rawurlencode($record['slug'])) ?>">Open</a>

For browser-generated answers/search, create text nodes or assign textContent; do not assign provider strings to innerHTML. HTML escaping is not JavaScript, SQL, or CSS escaping.

Candidate helpers, not installed KB APIs

The 0.2.0-rc.1 reference additionally supplies Escaper::url() for reviewed link syntax plus HTML attribute encoding, and Escaper::json() for JSON with HTML-sensitive characters encoded. URL encoding is not an outbound or redirect origin policy. Do not add these calls to this KB until a separate dependency adoption; its current vendor has not been changed by a content import.

Candidate authenticated responses force private no-store and the default security middleware adds same-origin CSP. Review explicit nonce/source policies when an application needs inline or external assets; never weaken CSP simply to accept an unsafe snippet. Markup helpers are not browser/screen-reader proof.

Verify

Test quote characters, Unicode, script-looking text, and invalid URLs. See Views and Authentication and security.

Editorial provenance

Source: resources/guides/output-escaping.md. Source SHA-256: 41fda5726e82306132ec405ebdc2522d307c2f06ff9ce4e0309ab45e24036c62.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.