Escape HTML entities
What is an Html Entities?
Some characters have special meaning in HTML. A less-than sign starts a tag and an ampersand starts an entity, so displaying them as text requires escaping them as HTML entities. Escaping is also a key defence against cross-site scripting (XSS) when inserting user input into pages. This tool escapes and unescapes HTML entities.
How to use it
- Paste text to escape it for safe use in HTML.
- Or paste HTML containing entities to decode it back to plain text.
The essential entities
<for the less-than sign>for the greater-than sign&for the ampersand"for a double quote'for an apostrophe
Example
The text <script>alert('x')</script> escapes to <script>alert('x')</script>, which the browser displays as text instead of running it.
Named, decimal and hex entities
The copyright sign can be written as ©, © or ©. In UTF-8 pages you can usually type the character directly; only the five special characters above must be escaped.
Escaping and security
- Escape untrusted data based on where it goes: element content, attribute values, URLs and JavaScript all need different encoding.
- Always quote attribute values and escape quotes inside them.
- Modern frameworks such as React, Vue and Angular escape text by default; the danger lies in raw HTML APIs like
innerHTMLandv-html.
Frequently Asked Questions
Which characters must be escaped in HTML?
The less-than sign, the greater-than sign and the ampersand in text, plus quotes inside attribute values.
What is the difference between named and numeric entities?
Named entities use a name like copy, while numeric entities use the Unicode code point in decimal or hex. Both produce the same character.
Does escaping HTML prevent XSS?
Escaping output for the correct context is a core defence, but it must be done consistently for every place untrusted data is inserted.
Do I need entities for accented letters?
Not in UTF-8 pages. You can type characters like é directly.