Web Vulnerabilities
Output Encoding
Also: output escaping, HTML escaping
Converting characters that have special meaning in a context (such as < in HTML) into harmless text before inserting data there.
In more detail
Encoding must match the destination: HTML text, an HTML attribute, a URL and a JavaScript string each need different rules. Most template engines encode for HTML text by default; the dangerous calls are the ones named like raw, safe or innerHTML.