title: Guide to proper escaping in Play framework
body: <p>I'm trying to map out how the Play framework supports escaping.</p>
  
  <p>This is a nice page spelling out the needed functionality:
   <a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet" rel="nofollow noreferrer">https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet</a></p>
  
  <p>So I'm trying to relate that to Play template features and fully understand what Play does and doesn't do.</p>
  
  <ul>
  <li>HTML escaping: <code>${}</code> or the <code>escape()</code> function</li>
  <li>Attribute escaping: I can't find a built-in solution</li>
  <li>JavaScript escaping: there's an <code>escapeJavaScript()</code> <a href="http://www.playframework.org/documentation/1.2/javaextensions" rel="nofollow noreferrer">http://www.playframework.org/documentation/1.2/javaextensions</a></li>
  <li>CSS escaping: I can't find a built-in solution</li>
  <li>URL escaping: nothing special built-in, but usual Java solution e.g. <a href="https://stackoverflow.com/questions/607176/java-equivalent-to-javascripts-encodeuricomponent-that-produces-identical-output">Java equivalent to JavaScript&#39;s encodeURIComponent that produces identical output?</a>  - Update: there's urlEncode() at <a href="http://www.playframework.org/documentation/1.2/javaextensions" rel="nofollow noreferrer">http://www.playframework.org/documentation/1.2/javaextensions</a></li>
  </ul>
  
  <p>Another point of confusion is the support for <code>index.json</code> (i.e. using templates to build JSON instead of HTML). Does <code>${}</code> magically switch to JavaScript escaping in a JSON document, or does it still escape HTML, so everything in a JSON template has to have an explicit <code>escapeJavaScript()</code>?</p>
  
  <p>There's also an addSlashes() on <a href="http://www.playframework.org/documentation/1.2/javaextensions" rel="nofollow noreferrer">http://www.playframework.org/documentation/1.2/javaextensions</a> , but it doesn't seem quite right for any of the situations I can think of. (?)</p>
  
  <p>It would be great to have a thorough guide on how to do all the flavors of escaping in Play. It looks to me like the answer is "roll your own" in several cases but maybe I'm missing what's included. </p>