What is the difference between html-escape and html-entity-encode?

html-escape only converts the five HTML-special characters ( & " '). html-entity-encode converts all non-ASCII characters to numeric entities too, producing fully ASCII-safe output.

Is escaping enough to prevent XSS?

Escaping prevents XSS when inserting text into element content or quoted attributes. It is NOT sufficient for unquoted attributes, URL attributes (use url-encode), or script/style contexts — those need context-specific handling.

Codificar special characters for safe insertion into HTML

Escapar <, >, &, ", and ' in user-supplied text so it can be placed inside HTML without triggering XSS or breaking markup.

1

Five characters have special meaning in HTML: < and > delimit tags, & starts entities, " and ' delimit attribute values. Leaving them unescaped in user content allows XSS attacks and breaks markup.
2

Escape HTML →
Paste text containing <, >, &, quotes. The tool replaces them with < > & " ' — safe for both element content and attribute values.
3

Codificador de entidades HTML →
For full Unicode entity encoding (not just the five specials), use this tool to convert all non-ASCII characters to numeric entities as well.
4

Decodificador de entidades HTML →
Invertir the process: paste entity-encoded text to recover the original characters for display or editing.

Preguntas frecuentes

What is the difference between html-escape and html-entity-encode?: html-escape only converts the five HTML-special characters (< > & " '). html-entity-encode converts all non-ASCII characters to numeric entities too, producing fully ASCII-safe output.
Is escaping enough to prevent XSS?: Escaping prevents XSS when inserting text into element content or quoted attributes. It is NOT sufficient for unquoted attributes, URL attributes (use url-encode), or script/style contexts — those need context-specific handling.