Which response is recommended when untrusted text must be included in an HTML page?

### Why this is right Escaping converts characters so untrusted input is displayed as data rather than interpreted as page markup or script. The material advises keeping untrusted content out of unsafe locations and escaping it when it must be included. ### The concept Cross-site scripting occurs when attacker-controlled content is inserted into a page delivered to a client. Context matters: content placed in scripts, comments, attribute names, tag names, or CSS can be unsafe. Proper sanitization libraries and correctly used JavaScript frameworks can also help. ### The other options - **Place it directly inside a script element**: the material explicitly warns against putting untrusted content there. - **Treat it as a trusted attribute name**: attacker-controlled data should not determine markup structure. - **Disable all input validation**: this removes a useful protective layer. ### Terms - **Cross-site scripting (XSS)**: inserting attacker-controlled content into a page received by a client. - **Escape**: transform characters so they are treated as data in a particular context. ### Remember Treat untrusted page content as data, never as trusted markup or code.