title: auto-escape to prevent XSS
body: <p>(when rendering a HTML template)</p>
  
  <pre><code>&lt;hidden name=”param${ns?htmlattr}” /&gt;
  &lt;a href=”${url?urlencode}”&gt;${usercontent?htmlencode}&lt;/a&gt;
  ${rawhtml?htmlliteral}
  &lt;script&gt;
  var a = “${str?jsstr}”; //null becomes “”
  var b = ${str?quote,jsstr}; //allow null, render quotes if nonnull
  var c = ${func?jsliteral}
  var ${func?jsidentifier} = null;
  &lt;/script&gt;
  </code></pre>
  
  <ul>
  <li>jsstr escapes <code>\t\b\f\n\r\\\'\"</code> and <code>&lt;/</code></li>
  <li>jsliteral escapes <code>&lt;/</code></li>
  <li>jsidentifier replaces non-alnum with a dummy character</li>
  <li>xmlattr escapes <code>&lt;&gt;&amp;</code> and filters characters that aren't legal UTF-8</li>
  <li>htmlencode encodes almost all edge cases into stuff like <code>&amp;amp;</code></li>
  <li>quote causes a string to render out quoted (including empty), or <code>null</code></li>
  </ul>
  
  <p>A few of these might not be relevant for security--they just help the code stay sane. Which escape mode do we choose as the default to help prevent XSS -- be "more secure" by default? What if we default to the most restrictive (htmlencode) and relax/switch excape modes from there?</p>
  
  <p>I'm not interested in discussing the merits of all these escape modes -- for better or worse, they all exist in our codebase. Am I missing any modes? Any good reading material?</p>