Context-aware encoding is the practice of escaping user-controlled data based on the exact place it will be rendered. The rules are different for HTML text, HTML attributes, JavaScript strings, URLs, and CSS, because each parser treats special characters in its own way. For example, angle brackets may matter in element text, quotes matter in attributes, and backslashes or line breaks may matter inside script blocks.
This matters because generic “HTML escaping” is not always enough to prevent cross-site scripting. If a developer uses the wrong encoder for the sink, crafted input can break out of its container and become executable markup or script. In real attacks, this often shows up in exported pages, email templates, or web apps that mix text and code. Defenders use context-aware encoding in templates, together with sanitization for allowed rich content and regression tests for dangerous characters like <, >, quotes, and event-handler payloads.