Why is < so important in HTML?

, , ). The entire HTML parsing model revolves around detecting <. This is why you must escape it as < in text content — an unescaped < makes the parser think a new tag is starting, breaking the document or enabling XSS attacks.

What is XSS and how does < relate to it?

Cross-Site Scripting (XSS) happens when user input containing is rendered as HTML. The < tells the browser to start parsing a tag, and the attacker's JavaScript executes in the victim's browser. Escaping < to < in all user-generated content is the primary defense.

What does < mean in shell redirection?

< redirects a file's contents as stdin for a command (sort < data.txt). << starts a 'here document' for inline multi-line input. <<< is a 'here string' in Bash (grep pattern <<< 'search this text'). These different forms all feed input to commands.

What are angle brackets used for in generics?

In Java, TypeScript, C#, and Rust, delimit type parameters: List , Array , Vec . The parser must distinguish between > parsing problem (was it two > or a right-shift?).

Less-Than Sign

Q: What is XSS and how does < relate to it?

Cross-Site Scripting (XSS) happens when user input containing is rendered as HTML. The < tells the browser to start parsing a tag, and the attacker's JavaScript executes in the victim's browser. Escaping < to < in all user-generated content is the primary defense.

Q: What does < mean in shell redirection?

< redirects a file's contents as stdin for a command (sort < data.txt). << starts a 'here document' for inline multi-line input. <<< is a 'here string' in Bash (grep pattern <<< 'search this text'). These different forms all feed input to commands.

Q: What are angle brackets used for in generics?

In Java, TypeScript, C#, and Rust, delimit type parameters: List , Array , Vec . The parser must distinguish between > parsing problem (was it two > or a right-shift?).

< (Less-Than Sign) is ASCII code point 60 (0x3C), Unicode U+003C, and a printable punctuation character. It expresses an inequality — the small end of the angle points at the smaller value, a visual mnemonic so intuitive it barely needs explaining once you see it. In code, < compares values in every language imaginable, but its responsibilities extend far beyond arithmetic. It opens every HTML and XML tag (<div>, <?xml>), making it the single character most responsible for the structure of the web. C++ overloads it for stream input (std::cin >> x), templates (vector<int>), and bitwise left shift. Shell scripting uses < for input redirection, feeding file contents into a command's stdin. The character's most consequential trap is its role in cross-site scripting: if a web application reflects user input into HTML without escaping < into <, an attacker can inject <script> tags and execute arbitrary JavaScript in other users' browsers. This single character's presence in unsanitized output is the root cause of one of the most persistent vulnerability classes in web security history. The symbol entered mathematical notation in 1631, introduced by Thomas Harriot in a posthumously published work, though Harriot himself had died a decade earlier and never saw his notation adopted. UTF-8 encodes it as a single byte 0x3C. Unicode classifies it as Sm (Symbol, Math) with the name LESS-THAN SIGN. The visually similar single left-pointing angle quotation mark ‹ (U+2039) and the mathematical ≤ (U+2264) for "less than or equal" are the characters most likely to appear when someone reaches for 0x3C and grabs the wrong one.

Symbol

Technical Details

Code Example

</>

int n = 7;
// Boundary check using '<'
const char *msg = (n < 10) ? "single-digit" : "10+";
// Avoid off-by-one by choosing < vs <=

Frequently Asked Questions

< opens every HTML tag (<div>, <p>, <img>). The entire HTML parsing model revolves around detecting <. This is why you must escape it as < in text content — an unescaped < makes the parser think a new tag is starting, breaking the document or enabling XSS attacks.
Cross-Site Scripting (XSS) happens when user input containing <script> is rendered as HTML. The < tells the browser to start parsing a tag, and the attacker's JavaScript executes in the victim's browser. Escaping < to < in all user-generated content is the primary defense.
< redirects a file's contents as stdin for a command (sort < data.txt). << starts a 'here document' for inline multi-line input. <<< is a 'here string' in Bash (grep pattern <<< 'search this text'). These different forms all feed input to commands.
In Java, TypeScript, C#, and Rust, < > delimit type parameters: List<String>, Array<number>, Vec<i32>. The parser must distinguish between < as 'less-than' and < as 'start of type arguments.' This ambiguity caused the C++ >> parsing problem (was it two > or a right-shift?).

Less-Than Sign

Symbol