Display a reader’s text without executing it
Your objectiveDistinguish content from browser instructions.
Understand the idea.
Search text and correction submissions are data supplied by a reader. When that data appears in a page, it must remain text rather than become executable markup. Escaping belongs at the output boundary. Input limits and content-type checks address different concerns and should not be mistaken for escaping.
A worked example.
A search for a string that looks like an HTML tag should show an ordinary query or an empty result. It should not insert a new page element or run a script. The search can be useful without accepting the query as browser code.
Try the reasoning.
In the local review site, search for a harmless angle-bracketed phrase. Observe whether it is displayed as text and whether the result page remains usable. Do not test against a site you do not control.
Carry it into practice.
Add an output-escaping regression test and a separate test for oversized requests.
Read the reference: MDN · Content Security Policy ↗