HTML / escape / context boundary
Separate HTML escaping contexts
Review text, attribute and URL contexts separately, including quote and entity boundaries. No real HTML or script is handled; only a local review note is produced.
Five context boundaries
Treating HTML escaping as one conversion can mix display, attribute and URL destinations. Record the output context and its allowed conditions separately.
text ≠ attribute ≠ URL / classify → escape → verify| Context | Review |
|---|---|
| text | Display a value without interpreting it as HTML. |
| attribute | Keep quote boundaries closed so the value cannot leave the attribute. |
| URL | Check HTML escaping separately from the allowed scheme and URL policy. |
| quote | Review single quotes, double quotes and ampersands separately. |
| entity | Do not mix a displayed character with its destination context. |
Safe review order
- Classify the destination as text, attribute or URL.
- Review quote and entity boundaries with synthetic examples.
- Check allowed URL schemes separately from HTML escaping.
- Approve the note before returning to any script context.
This page does not parse or execute real HTML and accepts no user input. It uses synthetic cases only.
Six synthetic cases
| case | result |
|---|---|
text-context | Text context |
attribute-context | Attribute context |
url-context | URL context |
quote-boundary | Quote boundary |
entity-reference | Entity reference |
unsupported-script-context | Reject |