Search code examples
jsonasp.net-web-apihtml-encode

Should I HTML encode response of my Web API

I am designing a Web API which returns JSON as the content-type, the response body could contain characters like ', ", < and >, they are valid characters in JSON. So, my question is should I do HTML encode for my Web API response body or should I leave this task to HTML client who is consuming my Web API?

Solution

  • No; you must not.

    You must only escape data if and when you concatenate it into a structured format.

    If you return JSON like { "text": "Content by X &amp; Y" }, anyone who reads that JSON will see the literal text &amp;.
    It will only work correctly for extremely broken clients who concatenate it directly into their HTML without escaping.

    In short:

    Never escape text except when you're about to display it