HTML Entity Encoder / Decoder
Escape HTML characters to entity equivalents (<, >, &) and parse encoded entities back to raw HTML.
Why Escape HTML Entities?
HTML entity encoding converts special characters like <, >, &, and " into their corresponding HTML entity codes (<, >, &). This prevents web browsers from interpreting user inputs as executable HTML code, protecting applications against Cross-Site Scripting (XSS) vulnerabilities.
Frequently Asked Questions
Which characters must be escaped in HTML?
The five core characters that should always be entity-encoded are ampersand (&), less-than (<), greater-than (>), double quote ("), and single quote (').
Frequently Asked Questions
What is the difference between Named Entity References and Decimal Code Points?
Named entity references use mnemonic character strings (such as < for <, > for >, and & for &) making them easy to read in source code. Numeric entities explicitly specify character positions in Unicode decimal format (e.g. < or &).
How does HTML Entity Encoding prevent Cross-Site Scripting (XSS)?
Cross-Site Scripting occurs when web browsers interpret untrusted user input as executable HTML tags (like <script>). Entity encoding converts reserved HTML characters into plain text representation so the browser safely renders the literal text instead of executing script code.
Protecting Web Apps with Entity Escaping
Entity escaping is a foundational web security practice. By converting raw HTML syntax symbols into safe character entity strings (like <div>), web applications safely display user-generated text without executing un-sanitized scripts.