This lesson's interactive features are locked, please to keep using them

Fix Cross-Site Scripting

Go's html/template package performs contextual escaping. It tracks where a value appears and encodes an ordinary string for that context:

<p>{{.ReviewBody}}</p>
<a href="{{.ProfileURL}}">Profile</a>
<script>
  const displayName = {{.DisplayName}};
</script>

In HTML text, < becomes < instead of starting a tag. In a URL attribute, an unsafe scheme such as javascript: is filtered. In JavaScript, a string becomes a quoted JavaScript value rather than source code.

Contextual escaping works only while values remain ordinary Go types. Types such as template.HTML, template.URL, and template.JS tell the engine to trust content that would otherwise be escaped.

Never convert untrusted input to a trusted template type. Those types are escape hatches for content your application already knows is safe.

Client-side code needs the same discipline. Prefer textContent when inserting text into the DOM. Use innerHTML only when the feature truly needs HTML and the value has been processed by a maintained HTML sanitizer.

XSS Variants

Reflected XSS: request input is immediately reflected into a response.
Stored XSS: input is saved and rendered later, like a product review.
DOM-based XSS: client-side JavaScript writes an untrusted value through an unsafe DOM API.