impossible that someone could pass the script language name with an embedded html character as query parameter for examplea url such asembeds in the language name parameter (the name is <bwhen submittedthis version uses cgi escape to properly translate the for use in the reply htmlaccording to the standard html escape conventions discussed earlierhere is the reply text generatedlanguages syntax &lt; sorry-- don' know that language the original version in example - doesn' escape the language namesuch that the embedded < is interpreted as an html tag (which makes the rest of the page render in bold font!as you can probably tell by nowtext escapes are pervasive in cgi scripting--even text that you may think is safe must generally be escaped before being inserted into the html code in the reply stream in factbecause the web is text-based medium that combines multiple language syntaxesmultiple formatting rules may applyone for urls and another for html we met html escapes earlier in this urlsand combinations of html and urlsmerit few additional words url escape code conventions notice that in the prior sectionalthough it' wrong to embed an unescaped in the html code replyit' perfectly all right to include it literally in the url string used to trigger the reply in facthtml and urls define completely different characters as special for instancealthough must be escaped as &ampinside html codewe have to use other escaping schemes to code literal within url string (where it normally separates parametersto pass language name like & to our scriptwe have to type the following urlhere% represents &--the is replaced with followed by the hexadecimal value ( of its ascii code value ( similarlyas we suggested at the end of to name +as query parameter in an explicit urlmust be escaped as % bsending +unescaped will not workbecause is special in url syntax--it represents space by url standardsmost nonalphanumeric characters are supposed to be server-side scripting