Question

Well, I know that “correct” escaping will help to prevent SQL injection.

But I saw people escaping values in HTML

<input type="text" value =/"some/" /> <!-- some escaped, why? -->

Question is:
Why to escape in HTML?

Answer 1

<input type="text" value =/"some/" /> <!-- some escaped, why? -->

That is a syntax error. Don’t do that.

Use character references to represent special characters (&, <, etc).

Why to escape in HTML?

(Assuming you use the correct syntax to do so): because some characters have special meaning in HTML. For example, you don’t want a " (in the data) ending your attribute value prematurely since that can:

• Lose data
• Lose data but have it display in the page
• Allow third parties to inject their JavaScript into your pages and steal data / redirect people to phishing sites / etc