--- title: "Escape everything you show ยท Agent Wranglers" url: https://agentwranglers.se/playbook/application-security/input-and-injection/cross-site-scripting id: APS-3 level: Required risk: takeover updated: 2026-10-27 build: a2a6bdfed830 tokens: 1343 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Escape everything you show For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: APS-3 - Level: Required - Chapter: [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md) - Rule: Escape untrusted text for the place it lands in a page, and back it up with a strict Content Security Policy. - Check: Put `PENTEST` and `">` in every field that shows up again, such as names, reviews and search terms. Put `javascript:alert('PENTEST')` in every link field, such as a website address. The page shows the text as typed, runs nothing and refuses the link. The page's `Content-Security-Policy` header has a nonce or hashes in `script-src`, plus `'strict-dynamic'`, `object-src 'none'` and `base-uri 'none'` or `'self'`. A list of allowed hosts alone fails, because such lists are easy to bypass. - Risk: An account or system taken over - How: Use a template system that escapes by default, such as Jinja2, Twig, Razor or React. Avoid its raw output switch, such as `|safe` or `dangerouslySetInnerHTML`. In the browser, set `textContent`, not `innerHTML`. Clean rich text with a sanitiser such as DOMPurify. Allow only `http:` and `https:` in links that users supply, because escaping does not stop a `javascript:` link. Block inline scripts with a [Content Security Policy](https://agentwranglers.se/playbook/application-security/browser-security-headers.md). The website rules [allow only the scripts you wrote](https://agentwranglers.se/playbook/application-security/browser-security-headers/content-security-policy.md) and [lock down risky DOM writes](https://agentwranglers.se/playbook/application-security/browser-security-headers/trusted-types.md) cover the browser side. ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### JavaScript example ```js // Bad el.innerHTML = review.text; // Good el.textContent = review.text; ``` ### Python example ```python # Python: escape before building HTML by hand (Jinja2 and Django templates do this for you) from markupsafe import escape html = f"

{escape(review_text)}

" ``` ### PHP example ```php // PHP echo '

' . htmlspecialchars($review, ENT_QUOTES, 'UTF-8') . '

'; ``` ## Sources - [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) - [W3C Content Security Policy Level 3](https://www.w3.org/TR/CSP3/) ## Related rules - STK-27 [Use DOMPurify or nh3 to clean user HTML](https://agentwranglers.se/playbook/stack/web-frameworks/html-sanitiser.md) in Software choices - CSS-35 [Keep untrusted data out of stylesheets](https://agentwranglers.se/playbook/html-css/structure-and-files/untrusted-data-in-css.md) in HTML and CSS - CSS-37 [Never read elements through window globals](https://agentwranglers.se/playbook/html-css/html-structure-and-reuse/no-named-element-globals.md) in HTML and CSS - CSS-24 [Clone markup that scripts add from a template element](https://agentwranglers.se/playbook/html-css/html-structure-and-reuse/template-element.md) in HTML and CSS - DSK-35 [Insert text into web pages as text from content scripts](https://agentwranglers.se/playbook/desktop-apps/browser-extensions/content-script-dom.md) in Desktop apps and extensions - LOC-47 [Escape translated text like user input](https://agentwranglers.se/playbook/localization/messages-and-translation/escape-translations.md) in Localization - SRH-1 [Search with the database's own full-text index](https://agentwranglers.se/playbook/search/engines-and-indexes/database-full-text-search.md) in Search - APS-25 [Allow only the scripts you wrote](https://agentwranglers.se/playbook/application-security/browser-security-headers/content-security-policy.md) in Application security - APS-35 [Lock down risky DOM writes](https://agentwranglers.se/playbook/application-security/browser-security-headers/trusted-types.md) in Application security - APS-36 [Sending the old XSS filter header](https://agentwranglers.se/playbook/application-security/browser-security-headers/x-xss-protection.md) in Application security **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers application security playbook`. In code you write, add a comment next to it with the same link. - Previous: [Keep query operators out of document database input](https://agentwranglers.se/playbook/application-security/input-and-injection/nosql-injection.md) - Next: [Never pass input to a shell](https://agentwranglers.se/playbook/application-security/input-and-injection/command-injection.md) - [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md)