Back to Blog
Escaping Test: <script>alert(1)</script> & "quotes" & ampersands
Excerpt containing <b>HTML tags</b>, an & ampersand, a "double quote", a 'single quote', and a {{template}} placeholder.
<b>Author With Tags</b>11 July 20261 min read
<script>alert('xss')</script> — this must appear as literal text, never execute.
<img src=x onerror=alert(1)> and <iframe src="javascript:alert(1)"></iframe> must also render as text.
SQL-looking text: '; drop table blog_posts; -- and {{ jinja }} and {{mustache}} placeholders.
Markdown-looking text: **not bold**, _not italic_, [not a link](https://example.com), `not code`.
<b>Title with tags</b>
Callout title and body both carry markup-looking text.
| <th> | & |
|---|---|
| <td> | & < > " ' |
TaggedSecurityEdgeEscaping