javascript - Why is simplejson encoder for html escaping with \\u0026 instead of & letting an XSS happen? -
i trying automatically html escape strings going json objects. simplejson has jsonencoderforhtml supposed that. how escapes html: chunk = chunk.replace('&', '\\u0026') chunk = chunk.replace('<', '\\u003c') chunk = chunk.replace('>', '\\u003e') 1) why using these codes instead of html encoding cgi.escape uses? which is: chunk = chunk.replace('&', '&') chunk = chunk.replace('<', '<') chunk = chunk.replace('>', '>') each of them state: simplejson: to embed json content in, say, script tag on web page, characters &, < , > should escaped. they cannot escaped usual entities (e.g. &) because not expanded within tags. cgi.escape: replace special characters "&", "<" , ">" html-safe sequences. 2) part in bold mean here? other not understanding differences here, core of problem simpl