FrontendHaltSecurity·Intermediate·Conceptual·1 min read
What is the difference between encoding and sanitization?
Short interview answer
Context-aware output encoding makes data inert in a specific sink. Sanitization parses intentionally allowed HTML and removes disallowed elements, attributes, and URL schemes. A sanitizer must be maintained and configured for the intended context; regex is not an HTML sanitizer.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.