Practice · 2 of 3

HTML Encoder

Write encodeHTML(s) escaping exactly the five HTML-significant characters: & < > " '. Order matters — & must be escaped first. Write rendersAsText(html) returning true when encodeHTML was applied to the payload (the encoded string contains "<" and no raw "<").

Difficulty: intermediate

Press Submit to check your solution.

Back to lesson: Practice: XSS Sinks & Encoding — Practice