🔣 HTML Entities

escape < > & · named & numeric · decode back

Advertisement

Two directions, one guarantee: whatever the browser's parser accepts, this page produces, and whatever standard entities exist, it decodes using the browser's own table. Encoding escapes the five characters that break HTML (& < > " and '); the optional mode additionally turns every non-ASCII character into a numeric reference, which is how mail archives and legacy pages survive being copied through tools that mangle UTF-8.

—

When escaping is the whole security story

Injection bugs in web applications are overwhelmingly one forgotten escape: user text containing <script> that the page pastes straight into HTML. Context decides the rule — element text needs &/</> only, attribute values also need quote escaping (both named and numeric forms work anywhere), and JavaScript inside HTML needs neither of these and its own rules instead. Copying from this page is safe; the encoder emits no whitespace changes and re-encoding already-encoded text only touches the ampersands.

Part of Everyday Tools. Like everything on tukuk.org: free, no account, no tracking.

Advertisement
Advertisement