HTML Entities and Escaping

Updated 2026-09-10 · 3 min read

What HTML escaping does

HTML escaping turns special characters into entities so the browser displays them as text instead of interpreting them as markup. For example, < becomes < and & becomes &.

Characters you usually need to encode

The exact set depends on where the text is placed, but these five characters are the safest baseline when text will appear inside HTML content or attributes.

• Ampersand: & becomes &
• Less-than: < becomes <
• Greater-than: > becomes >
• Double quote: " becomes "
• Single quote: ' becomes '

Escaping helps prevent XSS

If user input is inserted into a page as raw HTML, an attacker can try to add tags or event handlers that run JavaScript. Escaping neutralizes that input for display. It does not replace validation, content security policy, safe templating, or careful handling of URLs, but it is one of the basic layers that keeps text from becoming code.

Encoding vs decoding

Encode before displaying untrusted text in HTML. Decode only when you intentionally need to read already-encoded text, such as an exported CMS field, email template, or source snippet. Do not decode user input and then inject it as HTML unless it has been sanitized for the exact context.

Use the encoder

Open the HTML Encoder and Decoder, paste your text, then encode or decode entities instantly. It runs in your browser and is useful for templates, snippets, support replies, CMS fields, and debugging copied HTML source.

Frequently asked questions