How does Facebook strip html/apostrophes for XSS but also display it? Oh no; I am escaping it and sanitizing it now. It's just that websites like Facebook don't seem to be escaping anything [at least on the frontend], as I could write a HTML tag and it would still be displayed.