html5 - When is it appropriate to escape html entities? -

in server-side application every output passed through htmlentities function. in way can assure application xss safe.

but why input can't diplay htmlentities correctly? example, line of code :

  <input class="form-control" placeholder="name"    id="name" /> name.value = '&lt;script&gt;' 

note : &lt;script&gt; = htmlentities("<script>");

this code display word <script> inside bar. expected see <script>. right ?

wrong. htmlentities() job of converting characters html entities.

take following example , see yourself.

<input type="text" value="<?php echo htmlentities("<script>"); ?>" /> <input class="form-control" placeholder="name"    id="name" /> <input class="form-control" placeholder="name"    id="address" /> <script type="text/javascript">     document.getelementbyid("name").value = "<?php echo htmlentities("<script>"); ?>".replace(/&amp;/g,'&').replace(/&lt;/g,'<').replace(/&gt;/g,'>');     document.getelementbyid("address").value = "<?php echo htmlentities("<script>"); ?>"; </script> 

the difference lies in using javascript update value of html element , javascript puts escaped value on box. point have unescape escaped entities in case.