# HTML Injection

> Detects user-controlled input reflected in HTML without proper encoding, enabling HTML injection that may not execute scripts but can redirect or spoof content.

- Skill: `zakirkun/html-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/html-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/html-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/html-injection

---


# HTML Injection

## Overview
HTML injection allows attackers to insert arbitrary HTML markup into web pages. Unlike XSS, HTML injection may not involve script execution (e.g., blocked by CSP) but can still:
- Redirect users via injected `<meta refresh>`
- Spoof content with injected forms (phishing)
- Manipulate page structure to mislead users
- In some contexts, escalate to XSS

## Remediation
- HTML-encode all user output: `htmlspecialchars()`, `html.escape()`, `template.HTMLEscapeString()`
- Use auto-escaping template engines