URL Kodierung vs HTML Kodierung

问题

You sind building ein Web Seite das displays Benutzer Eingabe in both HTML content und ein URL, und you brauchen in know welche Kodierung in anwenden wo.

Voraussetzungen

• Basic HTML knowledge
• Basic URL structure knowledge

Schritte

1. 1. Understand the threat contexts

   URL encoding (percent-encoding) protects query strings from misinterpretation. HTML encoding (entity encoding) protects page content from XSS by neutralizing characters like <, >, and &. They solve different problems in different contexts.

   Eingabe

   <script>alert(1)</script>

   输出

   HTML: <script>alert(1)</script>

2. 2. Apply the correct encoding per context

   When placing user data inside HTML text, use HTML entity encoding. When placing user data inside a URL attribute (href, src), use URL encoding. For data inside a JavaScript string literal, use JavaScript string escaping.

   Eingabe

   O'Brien

   输出

   HTML: O'Brien | URL: O%27Brien

3. 3. Test both paths

   Render the page and inspect the DOM. Confirm that no raw < or > appears in HTML and that the URL resolves correctly. Automated scanners can verify that no XSS vector remains.

   Eingabe

   user input in both contexts

   输出

   no injection possible

Erwartetes Ergebnis

Benutzer Eingabe ist safely rendered in both HTML content und URL attributes ohne enabling XSS oder breaking links.

Häufige Fehler

Using URL encoding for HTML content

URL encoding does not neutralize < and > for HTML. Always use HTML entity encoding for content displayed in the page.

Forgetting to encode the ampersand in HTML attributes

Encode & as &amp; in HTML attribute values to avoid confusing the parser with entity references.

Troubleshooting指引

• If the page shows literal &lt; instead of <, you double-encoded. Decode once and re-encode only for the correct context.
• Use a framework's built-in escaping rather than manual encoding to avoid context mismatches.

Sicherheitsgrenzen

• Encoding is context-specific. Applying the wrong encoding leaves XSS or injection vulnerabilities open.