Home/ Questions/Q 7174937
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-28T16:10:12+00:00

When encoding possibly unsafe data, is there a reason to encode > ? It

  • 0

When encoding possibly unsafe data, is there a reason to encode >?

  • It validates either way.
  • The browser interprets the same either way, (In the cases of attr="data", attr='data', <tag>data</tag>)

I think the reasons somebody would do this are

  • To simplify regex based tag removal. <[^>]+>? (rare)
  • Non-quoted strings attr=data. 😮 (not happening!)
  • Aesthetics in the code. (so what?)

Am I missing anything?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Strictly speaking, to prevent HTML injection, you need only encode < as &lt;.

    If user input is going to be put in an attribute, also encode " as &quot;.

    If you’re doing things right and using properly quoted attributes, you don’t need to worry about >. However, if you’re not certain of this you should encode it just for peace of mind – it won’t do any harm.

    • 0