title: Why does HTML encoding prevent certain XSS attacks?
body: <p>I have been reading that you HTML encode on the way back from the server to the client (I think?) and this will prevent many types of XSS attacks. However, I don't understand at all. The HTML is still going to be consumed and rendered by the browser right? </p>
  
  <p>How is this stopping anything? </p>
  
  <p>I've read about this in multiple locations, websites and books, and nowhere does it actually explain <em>why</em> this works.</p>