For a semester exam, which option is correct about output encoding?

A. saving passwords in logs B. removing session timeout C. encoding data before display to prevent injection into output contexts D. opening all database access