Enthuware

I think there are two correct answers. I think URL encode is the secound correct one. Any other opinions?

Yes, as per https://www.owasp.org/index.php/XSS_(Cr ... heat_Sheet , URL Encoding of GET parameters is one of the several steps that should be taken to prevent XSS attacks.