HTML Entities Encoder

How to use HTML Entities Encoder

1. Paste the text you want to escape.
2. The encoded version appears immediately.
3. Copy it into your HTML, template or code sample.
4. The ampersand must be escaped before the other characters, or their entities get double-escaped.
5. XML defines only five entities — &, <, >, " and ' — so HTML-specific ones like   break an XML parser.
6. Encoding runs in your browser; content is not transmitted.

The five characters that matter

& must be escaped first, because escaping it after the others would double-escape their entities. Then < and >, which open and close tags. Inside an attribute value, the quote characters matter too: a double quote in an unescaped attribute closes it early and lets an attacker add their own attributes, including event handlers. Escaping those five in the right order is the whole of basic HTML escaping, and getting the ampersand order wrong is the classic implementation bug.

Escaping is contextual, and one function is not enough

HTML escaping protects text in an HTML body. It does not protect a value going into a JavaScript string, a URL, a CSS property or an unquoted attribute — each needs its own escaping, and using HTML entities in those places is both ineffective and visibly broken. This is why every serious security guide talks about context-aware output encoding rather than “sanitising input”. A value is not safe or unsafe in itself; it is safe or unsafe for a particular destination.

Escape at output, not at input

Storing escaped text in your database seems defensive and causes lasting trouble: the value is now wrong for every non-HTML use — an email, a CSV export, a search index, an API response — and passing it through a second escaping layer produces the &amp;lt; you see on badly built sites. Store exactly what the user typed, escape when you render, and escape for the context you are rendering into. Modern template engines do this automatically, which is why the bugs cluster around the places where developers deliberately bypass it.

Where it is used legitimately

Displaying code samples on a page, which is the commonest non-security use — a snippet of HTML has to be escaped or the browser renders it. Putting arbitrary text into an attribute. Including user-supplied names in a page. Preparing content for an XML feed, where only five entities are defined and &nbsp; will cause a parse error.