Text to HTML

Going from plain text to HTML is the direction where correctness matters most, because the output will be rendered by a browser, and anything in the input that looks like markup will be treated as markup unless you prevent it.

Escaping is the whole of the safety story. The less-than sign, the greater-than sign and the ampersand have meaning in HTML, so text containing them must have them converted to entities. Skip this and a piece of text containing a script tag becomes a script tag, which is how a comment field turns into a cross-site scripting hole. Any conversion that does not escape first is unsafe by construction, regardless of where the text came from.

Structure is the second decision. Plain text separates paragraphs with blank lines, and HTML needs explicit elements. Wrapping each block in a paragraph element is the usual answer and is what most readers expect. Converting single line breaks inside a paragraph into explicit break elements preserves the original wrapping, which is right for addresses and poetry and wrong for prose that was simply wrapped to a column width.

Whitespace behaves differently in HTML than in a text file. Runs of spaces collapse to one and line breaks are treated as spaces, so indentation and alignment that carried meaning in the source disappear. Text where the spacing matters needs a preformatted element rather than paragraphs, and that is a choice to make deliberately rather than notice afterwards.

Automatic linking of URLs is a convenience with a sharp edge: the same boundary problem as extracting links applies, so a link at the end of a sentence can swallow the full stop and produce a broken anchor in published output.

The conversion happens in your browser, which is worth having when the text being converted is unpublished content destined for a page.