What is the difference between html-escape and html-entity-encode?

html-escape only converts the five HTML-special characters ( & " '). html-entity-encode converts all non-ASCII characters to numeric entities too, producing fully ASCII-safe output.

Is escaping enough to prevent XSS?

Escaping prevents XSS when inserting text into element content or quoted attributes. It is NOT sufficient for unquoted attributes, URL attributes (use url-encode), or script/style contexts — those need context-specific handling.

Coder special characters for safe insertion into HTML

Échapper <, >, &, ", and ' in user-supplied text so it can be placed inside HTML without triggering XSS or breaking markup.

1

Five characters have special meaning in HTML: < and > delimit tags, & starts entities, " and ' delimit attribute values. Leaving them unescaped in user content allows XSS attacks and breaks markup.
2

Échappement HTML →
Paste text containing <, >, &, quotes. The tool replaces them with < > & " ' — safe for both element content and attribute values.
3

Encodeur d'entités HTML →
For full Unicode entity encoding (not just the five specials), use this tool to convert all non-ASCII characters to numeric entities as well.
4

Décodeur d'entités HTML →
Inverser the process: paste entity-encoded text to recover the original characters for display or editing.

Questions fréquentes

What is the difference between html-escape and html-entity-encode?: html-escape only converts the five HTML-special characters (< > & " '). html-entity-encode converts all non-ASCII characters to numeric entities too, producing fully ASCII-safe output.
Is escaping enough to prevent XSS?: Escaping prevents XSS when inserting text into element content or quoted attributes. It is NOT sufficient for unquoted attributes, URL attributes (use url-encode), or script/style contexts — those need context-specific handling.