title: How should you encode a textarea's contents
body: <p>If I have a text area that can display user entered input. How should I encode it to prevent any security issues?</p>
  
  <p>For instance suppose I have this:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;title&gt;Title&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
      &lt;form&gt;
          &lt;textarea&gt;&lt;/textarea&gt;&lt;script&gt;alert('Hello');&lt;/script&gt;&lt;/textarea&gt;
      &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>How should I encode the contents of the textarea so that it shows the <code>&lt;/textarea&gt;&lt;script&gt;</code> as text rather than running it?</p>
  
  <p>I'm using ASP.Net, but I'm really after a general answer for HTML.</p>
  
  <p>This is different to "<a href="https://stackoverflow.com/questions/4705848/rendering-html-inside-textarea">Rendering HTML inside textarea</a>" as I don't want to render HTML inside the textarea where as with that question they did.</p>