It depends on the context the injection happens.
Obviously, if the injection happens in the context of an elements content like this one:
<p>Your search for "❌" has returned the following results:</p>
< is required to switch from text to markup. But even here, if you echo user input in a
<script>var search = "❌";</script>
script element’s end tag, e.g.
Similarly, if you print user input in an element’s attribute value:
<input type="text" name="search" value="❌">
Here you have to take care of characters that are special for double quoted attribute values, i.e. the delimiting
" quote. If you’re using single quotes or no quotes at all, different rules need to be applied.
Additionally to that, you don’t just have to look for syntax but also for semantics. Like there are
So always take the context into account in which you want to put user supplied data and encode that data correspondingly.