Encode HTML-sensitive characters as safe named or numeric references.
The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.
Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.
Characters that could become markup are replaced with references according to text or attribute context; existing entities can be preserved or encoded again by mode. Numeric references retain the same Unicode code point.
<script>alert("XSS & injection")</script>
<script>alert("XSS & injection")</script>
Templates, code samples, and safe scraper storage encode HTML text.