HTML Entity Encoder
Escape HTML special characters to prevent markup injection and rendering bugs.
HTML Entity Encoder tool
The five characters that matter
| Character | Named | Numeric | Why |
|---|---|---|---|
| & | & | & | Starts every entity reference, so it must go first. |
| < | < | < | Opens a tag. Unescaped, user text becomes markup. |
| > | > | > | Closes a tag; escaped for symmetry and safety. |
| " | " | " | Breaks out of a double-quoted attribute value. |
| ' | ' | ' | Breaks out of a single-quoted attribute. ' is HTML5-only. |
Need to go the other way? Use the HTML Entity Decoder.
What this tool does
It converts characters that a browser would read as markup into entity references, so the text
displays as itself. Type an angle bracket and you get <; type an ampersand
and you get &. The document then shows your characters instead of
interpreting them.
Minimal scope escapes only the five characters that can change how a page parses. Aggressive scope additionally escapes everything above ASCII, which is useful when a downstream system mangles UTF-8 or when you need a file to be pure 7-bit.
Common uses
-
Showing a code sample on a page without it being executed — a blog post about
<script>tags needs them escaped or the post contains a script. - Putting a value safely inside an attribute, where an unescaped quote closes the attribute early and lets the rest be read as new attributes.
- Escaping a product name containing
&before it goes into a template. - Preparing content for an XML or RSS feed, which rejects a bare
&. - Converting accented characters to entities for a system stuck on ASCII.
A short example
Input:
<img src=x onerror=alert(1)>Escaped:
<img src=x onerror=alert(1)>The second version renders as visible text on a page. The first version runs.
Escaping is context-dependent
This is the part that trips people up: HTML entity escaping is correct for element content and for attribute values, and wrong almost everywhere else.
- Inside
<script>or<style>, entities are not decoded at all. Escaping there produces a literal&in your JavaScript, and the real hazard — a</script>sequence inside a string — is untouched. Serialise with JSON and escape the closing tag instead. - Inside a URL, you need percent-encoding, not entities. A
javascript:href is still dangerous when entity-escaped. - For an unquoted attribute, escaping the five characters is not enough, because a space or a backtick ends the value. Quote your attributes.
Worth knowing
Escape once, at output, not on the way into storage. Escaping at input means you cannot tell
later whether a stored & was an ampersand or someone genuinely typing
"&", and every additional render adds another layer.
In named mode the apostrophe is written as ' rather than
'. That name exists in XML and HTML5 but not in HTML 4, and the numeric
form is understood everywhere.
Frequently asked questions
Do I still need to escape if I use React or a template engine?
No, and doing it twice shows up on the page as a literal &. React escapes every string it renders, and Jinja, Django and ERB autoescape by default, so text escaped beforehand gets escaped again. Reach for manual escaping only where the framework hands control back — dangerouslySetInnerHTML, Vue’s v-html, a |safe filter — and at those points escaping alone is often not sufficient.
Which characters actually have to be escaped in body text?
Between tags, only an ampersand and a less-than sign can change how the document parses. A greater-than sign matters only where it would complete ]]>, and the quote characters matter inside an attribute value rather than outside one. Escaping all five anyway is the correct default, because text moves: a string that is safe in a paragraph today ends up in a title attribute tomorrow.