A hostel feedback page shows comments that students type in. If a comment is inserted into the page as raw HTML, the browser treats characters such as < as markup, which is how cross-site scripting (XSS) happens.
Write the output-encoding step: for every line of input, replace these five characters with their HTML entities and leave everything else unchanged:
| Character | Replace with |
|---|---|
& | & |
< | < |
> | > |
" | " |
' | ' |
Escaping is applied once, to the raw text. An & that is already part of an entity is escaped again (& becomes &amp;), because the input is plain text, not HTML.
Constraints
- At most 20000 characters in total.
Input and output
- Input
- One or more lines of text.
- Output
- The same lines, escaped.
Examples
Input 1
Mess food was <b>great</b> today
Tom & Jerry screening at 7Output
Mess food was <b>great</b> today
Tom & Jerry screening at 7The tags are shown as text. The & becomes &.
Input 2
He said "best fest ever"
It's 5 o'clockOutput
He said "best fest ever"
It's 5 o'clockDouble quotes become " and apostrophes become '.
Show hints
- Watch the order if you chain replace calls: if
&is not replaced first, the&inside<gets escaped a second time. - A one-pass character map avoids the ordering problem completely.
Show the explanation
One pass with a lookup table is the cleanest approach:
ESC = {"&": "&", "<": "<", ">": ">", '"': """, "'": "'"}
safe = "".join(ESC.get(ch, ch) for ch in line)Python's standard library already does this: html.escape(s, quote=True) produces exactly these five entities. In real code, use the library or your template engine rather than hand-written code.
If you chain `replace` calls, `&` must go first. Otherwise < becomes < and then its & becomes &lt;, which is double-escaped.
Why this prevents XSS. After encoding, the browser displays <b> as the literal text "<b>" instead of treating it as a tag, so user input can never become markup or script.
What interviewers want you to add
- Encode on output, for the right context. HTML body text, HTML attributes, JavaScript strings, URLs and CSS each have different rules. This function is right for HTML text and quoted attribute values. It is not enough inside a
<script>block, an unquoted attribute or anhref(wherejavascript:URLs must be blocked by allow-listing schemes). - Prefer frameworks that escape by default: React's JSX, Jinja2 or Django templates with autoescape, Thymeleaf. Avoid the escape hatches (
dangerouslySetInnerHTML,|safe,innerHTML) unless the content has been sanitised. - When users must submit rich HTML, use a well-maintained sanitiser with an allow-list (such as DOMPurify), not your own regular expressions.
- Defence in depth: a Content-Security-Policy header limits which scripts can run, and
HttpOnlycookies keep session tokens out of reach of JavaScript. - Input validation (length, allowed characters) helps, but output encoding is the main control against XSS.
Original UniCircle question. Last reviewed 22 Oct 2026.