Overview
Introduction
Any time user-supplied or external text lands in an HTML page, the characters <, >, and & risk getting read as markup instead of literal text. That's a display bug at best and a security hole at worst.
This is the write side of the encode/decode pair, what you reach for before text goes into HTML, not after. Unlike decoding, which reveals characters that were already escaped, encoding exists to stop untrusted or dynamic text from ever being interpreted as markup in the first place. That's why it's a foundational building block of XSS prevention, not just a formatting convenience.
What Is HTML Entity Encoder?
HTML encoding replaces the characters that have special meaning in markup with their named entity equivalents, & becoming &, < becoming <, and so on.
Five characters get this treatment because they're the ones with syntactic meaning in HTML: < and > delimit tags, & begins an entity reference, and " and ' delimit attribute values. Escaping exactly these five, nothing else, is enough to make arbitrary text inert as markup while leaving every other character, full Unicode text included, untouched.
How HTML Entity Encoder Works
The tool scans the input and replaces each occurrence of &, <, >, ", and ' with its corresponding named entity, leaving every other character, Unicode text included, untouched.
It's a single deterministic pass through a fixed character-to-entity mapping, not a general-purpose HTML sanitizer. It won't detect or remove dangerous content like inline event handlers or script tags. It just makes sure the five special characters can never be parsed as markup syntax, which is enough when the text is going in as content or an attribute value rather than raw HTML.
When To Use HTML Entity Encoder
Use it before manually embedding untrusted or user-generated text into raw HTML, when writing a static HTML snippet by hand, or when you're debugging why angle brackets in a string are rendering as tags.
It's most useful for one-off, manual situations: hand-writing an HTML snippet that includes a code sample with angle brackets, prepping a user comment for a static template outside your normal framework, diagnosing why a string with a quote or ampersand renders oddly in a browser. In a real application, this same escaping should happen automatically through your templating engine, not as a manual step.
Often used alongside HTML Entity Decoder.
Features
Advantages
- Prevents user-supplied text from being misinterpreted as HTML markup.
- Runs entirely client-side with no dependency on a server-side templating engine.
- Covers both element content and attribute-value contexts by escaping quotes as well.
Limitations
- This is a manual utility, not a substitute for your framework's automatic escaping. Always rely on your templating engine's built-in escaping in real applications.
- Doesn't sanitize or remove potentially dangerous content. It only escapes five specific characters.
HTML Encoding vs. URL Encoding
| HTML encoding (this tool) | URL encoding | |
|---|---|---|
| Escapes | &, <, >, ", ' | Reserved and unsafe URL characters |
| Used inside | HTML markup and attribute values | URLs and query strings |
| Prevents | XSS from unescaped markup | Broken links from unsafe characters |
| Typical entity format | & < | %20 %26 |
Examples
Best Practices & Notes
Best Practices
- In real applications, rely on your framework's automatic output escaping rather than manual encoding.
- Escape text at the point of output, not at the point of storage, so you don't double-encode data reused elsewhere.
- Always encode text placed inside HTML attribute values, not just element content.
- Don't rely on this escaping alone for text going into a <script> block, an event-handler attribute, or a URL. Use context-specific encoding for those cases instead.
- Always quote HTML attribute values. Escaping quote characters doesn't help an unquoted attribute, where even a space can end it early.
Developer Notes
This performs a single-pass character replacement using a fixed lookup table for the five HTML-significant characters (&, <, >, ", '), matched with a single regular expression and substituted via a callback into the corresponding entity. No third-party HTML parser or DOM is involved, which is why it's fast and predictable, but it also means it can't detect higher-level issues like an already-escaped string being escaped again. It has no way to know the input has already been through this transform once.
HTML Entity Encoder Use Cases
- Preparing a code sample containing angle brackets for display inside an HTML page
- Manually escaping a user comment before inserting it into a static HTML template
- Debugging why text with special characters renders incorrectly in a browser
- Escaping a value destined for a quoted HTML attribute, such as a title or alt text pulled from user input
- Understanding exactly what a framework's automatic output escaping is doing under the hood
Common Mistakes
- Relying on manual encoding instead of your framework's automatic escaping in production code.
- Encoding text twice, which turns & into &amp; and displays literally the wrong thing.
- Assuming escaped output is automatically safe for every context, including inside <script> tags, event handlers, or URLs, when it's only safe for HTML content and quoted attributes.
- Leaving an attribute value unquoted after escaping it. Escaped quote characters don't protect an attribute that has no quotes to break out of in the first place.
Tips
- Output showing &amp; instead of &? You've encoded it twice. Decode once to fix it.
- Pair with the HTML decode tool to verify a round trip before using the escaped text.
- Escaping text for a context other than HTML content or attributes, JavaScript, CSS, a URL? This tool's five-character set is the wrong one. Use encoding appropriate to that context instead.