Which security coding technique ensures that data displayed to users will not execute unintended code in the browser?

Which security coding technique ensures that data displayed to users will not execute unintended code in the browser?

• A. Input validation.
• B. Camouflage.
• C. Obfuscation.
• D. Output encoding.

Answer: (D)

Preventing the browser from running potentially harmful scripts is achieved by encoding data before it is displayed. Output encoding converts characters that could be interpreted as markup or code (like <, >, &, ", ') into their safe HTML representations (such as &lt;, &gt;, &amp;, &quot;, &#39;). When data is encoded, it is shown as plain text rather than executed as part of the page, which blocks cross-site scripting attacks. Input validation tries to reject bad data before it enters the system, but it isn’t sufficient on its own because encoded or context-dependent payloads can slip through or be crafted to bypass filters. Camouflage and obfuscation don’t address the underlying risk—they only disguise content, which attackers can often reverse or bypass. Output encoding, applied correctly for the specific rendering context (HTML, attributes, JavaScript, URLs), provides a reliable line of defense to ensure displayed data cannot execute unintended code.

Preventing the browser from running potentially harmful scripts is achieved by encoding data before it is displayed. Output encoding converts characters that could be interpreted as markup or code (like <, >, &, ", ') into their safe HTML representations (such as <, >, &, ", '). When data is encoded, it is shown as plain text rather than executed as part of the page, which blocks cross-site scripting attacks.

Input validation tries to reject bad data before it enters the system, but it isn’t sufficient on its own because encoded or context-dependent payloads can slip through or be crafted to bypass filters. Camouflage and obfuscation don’t address the underlying risk—they only disguise content, which attackers can often reverse or bypass. Output encoding, applied correctly for the specific rendering context (HTML, attributes, JavaScript, URLs), provides a reliable line of defense to ensure displayed data cannot execute unintended code.