Unescaped

“Unescaped” is a string subtype indicating that the string should contain arbitrary characters not escaped for HTML in any way, possibly including nulls or control characters.

Example content:

"The Man" & Capt. <Awesome>

If a string’s subtype is not explicit, for safety it should be assumed to be this subtype, and should be fully escaped before output.

Unescaped | Markup | TaglessMarkup | AttrValue

 

Leave a Reply

Elements allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>