Security with Go

HTML escaping output

Go has a standard function to escape a string and prevent HTML characters from getting rendered.

When outputting any data received by the user to the response output, always escape it to prevent cross-site scripting attacks. This applies equally whether the user-supplied data comes from a URL query, a POST value, the user-agent header, a form, a cookie, or the database. The following snippet gives an example of escaping a string:

package mainimport (   "fmt"   "html")func main() {   rawString := `<script>alert("Test");</script>`   safeString := html.EscapeString(rawString)   fmt.Println("Unescaped: " + rawString)   fmt.Println("Escaped: " + safeString)}