Which characters are escaped?

The five HTML special characters: & " and ' are escaped to & < > " and ' respectively. These are the minimum needed for safe HTML insertion.

What is the difference from HTML entity encoding?

HTML escape only handles the 5 special characters needed for safe HTML insertion, while HTML entity encoding can encode all non-ASCII characters as numeric entities (e.g. © → ©).

Does escaping prevent XSS?

Yes, when inserting untrusted text into HTML text content or attribute values. Escaping & " ' breaks out of tags and attributes. However, escaping alone is insufficient for URL attributes or JavaScript contexts.

Can I unescape entities?

Yes. Unescape mode converts & < > " ' and numeric entities (&#NN; / &#xNN;) back to characters. Unknown named entities are left as-is.

Why is ' escaped as ' instead of '?

' is not supported in older HTML4 browsers. ' (the numeric entity) is universally supported in both HTML and XHTML.

Is the & escaped first?

Yes. & is escaped first to avoid double-escaping. If < were escaped first, the & in < would be re-escaped to <, producing incorrect output.

Échappement HTML

Escape or unescape HTML special characters online. Gratuit, privé et 100% côté client.

Mode

Entrée

Essayer un exemple:

Sortie

Local only

Historique récent

Aucun historique

Utilisation

Saisissez ou collez du texte dans le champ de saisie.
Select escape or unescape mode.
Copy the result.

Tâches utilisant cet outil

Convertir HTML to JSX for React

JSX est HTML avec JavaScript expressions. Convertir HTML en JSX par closing void étiquettes, converting classe en className, et style chaînes en objets.

TÂCHE

Convertir HTML to Markdown

Convertir HTML content to Markdown for simpler editing, storage, or display in Markdown-aware systems. Handles headings, lists, links, images, and code blocks.

TÂCHE

Convertir Markdown to HTML

Rendre Markdown (headings, lists, code blocks, tables, links) en HTML pour afficher en browsers ou email.

TÂCHE

Lire HTML entities en pasted texte

Turn & < ' et friends back en real caractères — et know quand NOT en décoder.

TÂCHE

Coder special characters for safe insertion into HTML

Échapper <, >, &, ", and ' in user-supplied text so it can be placed inside HTML without triggering XSS or breaking markup.

TÂCHE

Prévenir clickjacking attacks

Clickjacking embeds your site en un invisible iframe et tricks utilisateurs en clicking. Apprendre X-Frame-Options et CSP frame-ancestors.

TÂCHE

Prévenir SQL Injection (SQLi) attacks

SQLi injects malicious SQL à travers utilisateur entrée. Apprendre parameterized queries, entrée validation, et le principe de least privilege.

TÂCHE

Prévenir XSS (Cross-Site Scripting) attacks

XSS injects malicious scripts en web pages. Apprendre entrée sanitization, sortie codage, et Content Sécurité Policy en prevent XSS.

TÂCHE

Utiliser le iframe sandbox attribute

Le sandbox attribute restricts iframe capabilities, preventing malicious embedded content de accessing le parent page.

TÂCHE

Pipelines utilisant cet outil

Échapper HTML et minifier

PIPELINE

Questions fréquentes

Which characters are escaped?: The five HTML special characters: & < > " and ' are escaped to their corresponding HTML entities.
What is the difference from HTML entity encoding?: HTML escape only handles the 5 special characters needed for safe HTML insertion, while HTML entity encoding can encode all non-ASCII characters as numeric entities.