title: What must the single quote, double quote, and slash be escaped in HTML contents?
body: <p><strong>Context</strong></p>
  
  <ul>
  <li>Inserting unsafe strings into the contents of an HTML tag
  
  <ul>
  <li>This example <strong>does not</strong> include inserting unsafe strings into HTML attributes</li>
  <li>This example <strong>does not</strong> include the case of inserting unsafe strings inside of a script tag</li>
  </ul></li>
  <li>The recommendations from <a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content" rel="nofollow">OWASP</a> that are parroted elsewhere</li>
  </ul>
  
  <p><strong>Background</strong></p>
  
  <ul>
  <li>I understand why the less-than sign (&lt;), greater-than sign (>), and ampersand (&amp;) need to be escaped before being put into the contents of an HTML tag (&lt; and > escaped make tags and the ampersand is roughly the HTML escape character)</li>
  <li>I can see why the slash (/) would be problematic if the less-than and greater-than signs weren't escaped, but they are</li>
  <li>I also understand how the double quote (") could be a problem if mixed into the attributes of an HTML element or in a script tag, but again, escaping the less-than and greater-than saves us from that case</li>
  <li>The single quote is a mirror of the double quote (as far as I know)</li>
  </ul>
  
  <p><strong>Question</strong></p>
  
  <ul>
  <li><p>If less-than, greater-than, and ampersand are escaped, is it really necessary to escape the single quote ('), double quote ("), and slash (/)? Why?</p></li>
  <li><p>Should HTML escaping be less general? Should there be different escape tactics used for inserting in the contents of an HTML tag versus inserting attributes? Are there other cases to consider?</p></li>
  </ul>
  
  <p><strong>Rebuttal to an answer I assume will be posted</strong></p>
  
  <ul>
  <li>"It's better to be safe than sorry"
  
  <ul>
  <li>Then why is it not recommended to escape the exclamation mark and hyphens because they're used for HTML comments?</li>
  <li>Should we escape all alphabetic characters because they could be used in tag and attribute names?</li>
  <li>To take this idea to the extreme, should we escape all characters?</li>
  </ul></li>
  </ul>