What's the difference between !, %, and @ in replacement tokens?

Question

I'm using the Message module on Drupal 7. For Replacement tokens, the help text says:

A comma-separated list of replacement tokens, e.g. %title or !url, of which the message text makes use of. Each replacement token has to start with one of the special characters "@", "%" or "!". This character controls the sanitization method used, analogously to the t() function.

What's the difference between %, !, and @? Are there standards about when I should use each symbol?

Answer 1

From the format_string() docs:

• @variable: Escaped to HTML using check_plain(). Use this as the default choice for anything displayed on a page on the site.
• %variable: Escaped to HTML and formatted using drupal_placeholder(), which makes it display as emphasized text.
• !variable: Inserted as is, with no sanitization or formatting. Only use this for text that has already been prepared for HTML display (for example, user-supplied text that has already been run through check_plain() previously, or is expected to contain some limited HTML tags and has already been run through filter_xss() previously).