Predict the output
What does html.escape turn the payload into?
import html
print(html.escape('<img src=x onerror=alert(1)>'))Hint 1 of 1
What do < and > become?
Choose an answer, then open Show answer below to check it.
Show answer
Answer: A <img src=x onerror=alert(1)>
Correct. Angle brackets become entities, so the browser shows text.
Escaping turns the characters that start HTML, like < and >, into entities. The browser shows the text instead of parsing a tag, so onerror never runs.
Why not the others?
- B
<img src=x onerror=alert(1)>. escape replaces < and >. - C An empty string. It encodes; it doesn't strip.
- D
img src=x onerror=alert(1). Characters are encoded, not removed.