$str is the input data. We use double quotes to wrap the value of the attribute; We represent the character using an escape string; When you need to use both single and double quotes you can use the following:" becomes " ' … The result will be a valid JavaScript string, but it won't work as HTML markup, because the HTML parser doesn't understand backslash escapes. Thanks, G Gopinath. How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security? If you use htmlspecialchars() to escape any HTML attribute, make sure use double quote instead of single quote for the attribute. \n: Insert a newline in the text at this point. Here are some examples to display double quotes in ASP. To insert characters that are illegal in a string, use an escape character. I want to put this string into a . Escape the compilers interpretation of ", and get " printed on the screen.. To insert a double quote " legally in a regular string in C#, use a backslash character \ before it, like \" to escape the double quote in string literal.. string text = "He said, \"Don't do it\""; Console.WriteLine(text); . Escape Sequences; Escape Sequence Description \t: Insert a tab in the text at this point. Let’s take a look at a simple but common example of a webpage with a search function. Found inside – Page 16Variables are parsed inside of a heredoc string, just as with double-quoted strings. $s = <<