Codieren special characters for safe insertion into HTML
Escapen <, >, &, ", and ' in user-supplied text so it can be placed inside HTML without triggering XSS or breaking markup.
- 1
Five characters have special meaning in HTML: < and > delimit tags, & starts entities, " and ' delimit attribute values. Leaving them unescaped in user content allows XSS attacks and breaks markup.
- 2 HTML-Escape →
Paste text containing <, >, &, quotes. The tool replaces them with < > & " ' — safe for both element content and attribute values.
- 3 HTML-Entity-Kodierer →
For full Unicode entity encoding (not just the five specials), use this tool to convert all non-ASCII characters to numeric entities as well.
- 4 HTML-Entity-Dekodierer →
Umkehren the process: paste entity-encoded text to recover the original characters for display or editing.
Häufige Fragen
- What is the difference between html-escape and html-entity-encode?
- html-escape only converts the five HTML-special characters (< > & " '). html-entity-encode converts all non-ASCII characters to numeric entities too, producing fully ASCII-safe output.
- Is escaping enough to prevent XSS?
- Escaping prevents XSS when inserting text into element content or quoted attributes. It is NOT sufficient for unquoted attributes, URL attributes (use url-encode), or script/style contexts — those need context-specific handling.
Workflows, die diese Aufgabe lösen
Verwandte Tools
HTML-Escape
Escape or unescape HTML special characters online. Kostenlos, privat und 100% clientseitig. WERKZEUG
HTML-Entity-Kodierer
Encode text to HTML entities online. Kostenlos, privat und 100% clientseitig. WERKZEUG
HTML-Entity-Dekodierer
Decode HTML entities back to readable text online. Kostenlos, privat und 100% clientseitig. WERKZEUG