Should I HTML encode response of my Web API
asp.net-web-api, html-encode, json
Solution
No; you must not.
You must only escape data if and when you concatenate it into a structured format.
If you return JSON like `{ "text": "Content by X & Y" }`, anyone who reads that JSON will see the literal text `&`. It will only work correctly for extremely broken clients who concatenate it directly into their HTML without escaping.
In short:
Never escape text except when you're about to display it
Problem
I am designing a Web API which returns JSON as the content-type, the response body could contain characters like `'`, `"`, `<` and `>`, they are valid characters in JSON. So, my question is should I do HTML encode for my Web API response body or should I leave this task to HTML client who is consuming my Web API?