title: Security benefits of encoding HTML special characters in JSON responses
body: <p>I have recently received a recommendation, from a third party, to encode HTML special characters in all server responses "for security reasons". So:</p>
  
  <pre><code>' --&gt; &amp;#x27;
  &amp; --&gt; &amp;#x26;
  </code></pre>
  
  <p>e.g.</p>
  
  <pre><code>{ "id": 1, "name": "Miles O&amp;#x27;Brien" }
  </code></pre>
  
  <p>Question: Is there a security gain in doing this, or is it just a paranoia?</p>