The payload is dropped straight into an HTML element's text content.
This is the key lesson: one fixed encoding scheme does not protect every sink. Only the context-correct encoder is safe in all four contexts.
| Mode | Output reaching the sink | Verdict |
|---|
Output encoding is the standard OWASP defense against cross-site scripting: transform untrusted data so it can only ever be interpreted as inert data by the sink it lands in, never as code. The catch is that "the sink" is not one thing — an HTML body, an HTML attribute, a JavaScript string literal and a URL query parameter each have their own escaping rules, and an encoder built for one of them can be actively unsafe in another.