Output safety depends on context

The same saved value can meet different browser rules.

Interpretation matters

An output context is the browser interpretation surrounding a value: ordinary text, an HTML attribute, a URL, or executable code. Protection must match that interpretation. Saving a value successfully does not make every later use safe.

For ordinary text, a framework’s text-rendering facility keeps the value as text rather than treating it as HTML. A link also needs a policy for permitted URL schemes and appropriate attribute handling. Encoding represents data safely in a particular context; it does not decide whether a destination is acceptable.

Fictional profile review

The club permits plain display names and links to ordinary HTTPS websites. Rich HTML biographies are outside this feature’s requirements.

• O1: Display names use the framework’s documented text-rendering feature, with no raw HTML option.
• O2: Website links use a generic helper labeled “escape text.” The review contains no URL-scheme policy or documentation for link-attribute handling.
• O3: A successful preview is offered as evidence that both fields are safe.

A bounded conclusion

O1 supports the intended text treatment, assuming the documented feature is used throughout that rendering path. O2 does not establish the two protections required for links. O3 shows one successful display, not coverage of other interpretations.

Require an HTTPS-only destination policy for this feature and a supported way to render the link attribute. Keep the stored name meaningful instead of removing legitimate punctuation. If rich text is added later, review a maintained HTML sanitizer and its allowed markup separately.

Deliverable: Approve the documented text path; keep link approval pending until its destination policy and rendering context are documented.