Why user text must be escaped

The parser turns text into elements by its punctuation — the angle brackets and ampersands you have watched it read all course. That is fine for text you wrote. But when a page places text that came from a user — a comment, a name, a search term — directly into its markup, the parser cannot tell whose text it is: it reads that punctuation as structure just the same. The defense is escaping: before untrusted text enters the page, the framework converts the syntactic characters to their character references (<, >, &, ") so the browser displays them as literal characters instead of interpreting them as markup. Every serious template engine escapes by default; the vulnerabilities happen where someone deliberately turned that off. The rule you carry as a markup author: user-supplied content is data to be shown, never markup to be run, and the boundary where it enters is where escaping belongs.

sandbox: contain an embedded page

An <iframe> loads a whole separate document — and if that document is not fully yours (an embed, a widget, anything third-party), sandbox is how you cap what it may do. Bare sandbox="" is maximum restriction: no scripts, no forms, no navigation of the top page, treated as a unique origin. You then add back only what the embed genuinely needs, token by token (allow-scripts, allow-forms…). One combination the checker itself warns about: granting allow-scripts and allow-same-origin together to a same-origin frame effectively lets the framed page remove its own sandbox — so the validator flags it as potentially pointless.

SRI: pin the third-party file you load

Loading a script from someone else’s server (a CDN) means running whatever they serve — including a version you did not review, if that server is ever compromised. Subresource Integrity closes that gap: integrity="sha384-…" carries a cryptographic hash of the exact file you tested, and the browser refuses to run the file if what arrives does not match. Third-party script and link get integrity plus crossorigin; your own same-origin files do not need it.

Safe exits

A target="_blank" link hands the new tab a reference back to your page unless you sever it — rel="noopener" does that (modern browsers default to it, but stating it is the reliable habit), and rel="noreferrer" additionally withholds the referring URL. These are the same tokens from HT-09, seen now as what they are: a trust boundary at every link that leaves your control.