Escape Special Characters

html.spec_char_escape

Severity

low

Remediation Complexity

low

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Html

Description

Flags text content that contains a raw < or a raw & that does not begin a character reference.

Rationale

In HTML text content the characters < and & have a structural meaning: a raw < starts a tag and a raw & starts a character reference. Leaving them unescaped is a parse risk — depending on what follows, the browser may swallow part of the text, misread it as markup, or recover in a way that differs from the author’s intent.

<p>a < b</p>           <!-- FLAW — raw < -->
<p>Tom & Jerry</p>     <!-- FLAW — bare & -->

<p>a &amp; b</p>       <!-- OK — escaped & -->
<p>x &lt; y</p>        <!-- OK — escaped < -->

Remediation

Write the special characters as character references: < for < and & for &. A > may be left as-is, but > is also acceptable.

References

MDN — Entity