HTML Entity Encoding Guide: Show Code Instead of Running It
The goal is not to make content safe. It is to make content display literally. Confusing those two is where things go wrong.
Open the tool：HTML Entity Encoder
When escaping is the right move
Paste a div tag with a class attribute into a blog post without escaping and the browser treats it as a real tag: the reader sees a box and the code disappears. Turn the angle brackets into entities and it shows up as text.
The same need appears in templates printing user input, in HTML emails assembled from fragments, and in static pages built from a rich-text editor. The content must be seen, not executed.
- Showing HTML or XML snippets on a page
- Templates that print user-supplied text
- Assembling fragments for email and static pages
Five characters, one order
Only five characters need escaping: the ampersand becomes &, the less-than sign becomes <, the greater-than becomes >, the double quote becomes ", and the single quote becomes '. The ampersand must go first, or entities you just created get escaped again.
Always quote attribute values; never write an unquoted title attribute. Because the tool escapes single quotes as well, an attribute wrapped in single quotes stays intact. Chinese, Japanese, and emoji are left alone, which keeps the output readable.
- Escape the ampersand first, then the other four
- Always wrap attribute values in quotes
- Leave non-ASCII characters alone for readability
Boundary: escaping is not XSS defence
XSS defence requires context-aware escaping. HTML body, attributes, JavaScript strings, CSS, and URLs all follow different rules, and a single pass of HTML entities will not stop every injection. The real defence sits in server-side templating and a content security policy.
Entities are also not encryption: the mapping is public and reversible. Do not use them to hide an email address or a key; that only adds a copy step. If the content comes from an untrusted source, still run it through an allow-list sanitiser before display.
- Context-aware escaping, not one global pass
- Entities are public and reversible, not encryption
- Untrusted content still needs allow-list sanitising
FAQ
Why only five characters?
Those are the only ones with syntactic meaning in HTML: the ampersand starts an entity, angle brackets delimit tags, and quotes delimit attribute values. Everything else, including Chinese, can stay as it is.
Do I still need XSS protection?
Yes. This escaping only ensures literal display. It does not cover JavaScript contexts, URL parameters, or CSS, so protection belongs on the server for each output context, together with CSP and input validation.
Should Chinese and emoji be escaped?
No. Modern pages are UTF-8, so writing them directly is more readable, and the tool leaves them intact. Numeric entities are only worth considering when the output must be pure ASCII.
Related tool：HTML Entity Encoder