cybersecurity · intermediate · ~25 min

HTML-escape user-provided text

Per-character expansion with bounded output.

Challenge

Implement int html_escape(const char *in, char *out, size_t cap). Replace:

  • & → &
  • < → &lt;
  • > → &gt;
  • " → &quot;
  • ' → &#39;

NUL-terminate out. Return bytes written (excluding NUL), or -1 if it wouldn't fit.

Why this matters

HTML escaping is the primary defense against XSS. Hand-rolling the escape teaches you exactly which characters carry meaning in HTML.

Input format

in null-terminated ASCII.

Output format

See API.

Constraints

No malloc. Cap >= 1.

Starter code

#include <stddef.h>
int html_escape(const char *in, char *out, size_t cap) { /* TODO */ return -1; }

Common mistakes

Escaping & last (your earlier & -> &amp; then gets re-escaped); using ' -> &apos; (not valid in HTML4); using bare snprintf-per-char (slow).

Edge cases to handle

Empty input. Input with no special chars. Buffer too small mid-escape.

Complexity

O(n).

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.