http://maverick.i2p/blog/darknet-dev
HTML output requires HTML entity encoding, JavaScript output requires JavaScript encoding, URLs require URL encoding, and CSS requires CSS encoding. Mixing contexts creates tiny interpretation gaps where payloads survive and execute. On top of encoding, you enforce a strict Content Security Policy that bans inline scripts, unsafe-eval, and wildcard sources so even if injection slips through, execution gets blocked at the browser layer.