HTML Entities
HTML entities escape characters with special meaning in HTML (<, >, &, ") into &name; or &#NNN; form so they display literally instead of being parsed as markup.
Purpose
They keep user input or dynamic content from being executed by the browser as HTML tags, and are a foundational defense against XSS.
Mechanism
Named entities such as < > & " ' cover the 5 XML-predefined characters. Numeric entities &#NNN; use a decimal code point, and &#xNNN; a hexadecimal one. Decoding expands them according to the DTD entity table.
Use cases
- Displaying < > & as text in HTML
- Output escaping for XSS defense
- Special symbols in HTML email
- XML content escaping
Examples
- Input
<script>Output<script>After escaping, the browser shows text instead of executing a script
Common errors
- Escaping only < and > while missing quotes, enabling XSS in attribute contexts
- Escape by context: text needs < > &; attributes additionally need " and '
Related terms
URL Encoding
URL encoding (percent-encoding) converts characters not allowed in URLs into %HH form, so arbitrary data can appear safely in URL components. GLOSSARY
XSS
XSS (cross-site scripting) is attackers injecting malicious scripts into a page that execute in other users browsers; it comes in stored, reflected, and DOM-based forms. GLOSSARY
Unicode
Unicode is the international character encoding standard that assigns a unique code point (U+0000 through U+10FFFF) to every character of nearly all the world's writing systems, with a codespace of 1,114,112 code points. GLOSSARY
Related tools
HTML Entity Encoder
Encode text to HTML entities online. Free, private, and 100% client-side. TOOL
HTML Entity Decoder
Decode HTML entities back to readable text online. Free, private, and 100% client-side. TOOL
HTML Escape
Escape or unescape HTML special characters online. Free, private, and 100% client-side. TOOL