Q: When should I encode HTML entities?

Encode any text that will be inserted into an HTML document to prevent characters like , and & from being interpreted as markup. This is especially important when displaying user-supplied content to prevent cross-site scripting (XSS) attacks.

Question 1

What are HTML entities?

Accepted Answer

HTML entities are special text sequences used to represent characters that have a meaning in HTML markup, such as less-than and greater-than signs, or characters not easily typed on a keyboard. They start with an ampersand and end with a semicolon, like & for & or < for <.

Question 2

When should I encode HTML entities?

Accepted Answer

Encode any text that will be inserted into an HTML document to prevent characters like <, >, and & from being interpreted as markup. This is especially important when displaying user-supplied content to prevent cross-site scripting (XSS) attacks.

Question 3

What is the difference between named and numeric entities?

Accepted Answer

Named entities use a short descriptive name, like " for a double quote. Numeric entities use the decimal or hexadecimal code point of the character, like &#34; or &#x22;. Both forms are equivalent and supported by all browsers.

Question 4

Does this tool handle all HTML entities?

Accepted Answer

The tool encodes the five characters that must always be escaped in HTML: &, <, >, ", and '. It also decodes all named entities defined in HTML5 as well as decimal and hexadecimal numeric entities.

Question 5

Is my text sent anywhere when I encode or decode?

Accepted Answer

No. All encoding and decoding runs entirely in your browser using JavaScript. Nothing you type or paste is transmitted to any server.

HTML Entities

Three steps to done

When to use this

Sanitize user input

Read HTML source

Template debugging

Free HTML entity encoder and decoder

Frequently Asked Questions

Related tools