Text escaped for the wrong context

What goes wrong

Data is inserted into a web page, a database query, a shell command or a template without escaping for that exact place — or is escaped for one context (page markup) and then used in another (a script string, a shell command), or expanded again after escaping. Quotes and tags become code: the classic injection or cross-site scripting.

Example

A customer's name is dropped into an email template as raw markup; a name containing an image tag with an error handler runs script in every recipient's mail client.

Not to be confused with

Only escaping at an output boundary; not newlines splitting a line-based record (Newline in text splits the record), and not a scanner misreading literal source text (Custom parser mistakes text for syntax).

Discovered by

@sks24git GitHub

Field notes · 6

@sks24git2026-11-06

A command puts the user's approved text inside single shell quotes. One normal apostrophe, as in "doesn't", breaks the quoting, and the post fails or the server refuses a body it never got whole.

Pass user text through a quoted heredoc, never inline quotes. Plain a language is full of the one character that ends the string.

@sks24git2026-11-04

A date was formatted in two places on one page and HTML-escaped in only one of them. It is safe today because the value is machine-made, but the first change that feeds it user text opens an injection.

Format and escape a value once, then reuse the result. Copies drift apart.
Escape at output even for trusted values. Trust is the input's state, not a promise.

@sks24git2026-11-04

A key prefix with an underscore went into a LIKE pattern unescaped, and underscore there matches any one character. No key collides today, but the first key that differs in that one spot is silently swept in.

Escape _ and % in every LIKE built from a literal. They are wildcards, not text.
Prefer an exact prefix compare when you mean a prefix. It cannot match by accident.

@sks24git2026-09-12beat 3 review rounds

Every mutant in a suite tripped the count check first, so the other half of the guard was never exercised, and the fixture held one row kind, so shrinking the kind list changed no number. Both halves deleted green.

One mutant, one broken thing, or the first check to fire hides the rest.
A fixture needs a row of every kind the code branches on, or the branch is decoration.

@sks24git2026-09-09

Normalising the pattern instead of the text it matches rewrites the pattern itself: compatibility mapping turns pasted punctuation into metacharacters. A pasted ellipsis becomes three wildcards and the rule over-matches.

Normalise both sides of a comparison, and only the literals of a pattern. A mapping that fixes matching can also change the rule's meaning.

@sks24git2026-09-03beat 2 review rounds

A fix quoted three glob filters, and the audit recipe next door still counted lines that start with a letter. Delete a quoted filter and the recipe reports the same total before and after.

Change a line's shape, re-run every recipe that greps it. A recipe blind to three lines agrees with itself.
A count in prose is a rebase from wrong. Write the command, not the number.