What is the difference between html-escape and html-entity-encode?

html-escape only converts the five HTML-special characters ( & " '). html-entity-encode converts all non-ASCII characters to numeric entities too, producing fully ASCII-safe output.

Is escaping enough to prevent XSS?

Escaping prevents XSS when inserting text into element content or quoted attributes. It is NOT sufficient for unquoted attributes, URL attributes (use url-encode), or script/style contexts — those need context-specific handling.

TASK

Encode special characters for safe insertion into HTML

Escape <, >, &, ", and ' in user-supplied text so it can be placed inside HTML without triggering XSS or breaking markup.

1

Five characters have special meaning in HTML: < and > delimit tags, & starts entities, " and ' delimit attribute values. Leaving them unescaped in user content allows XSS attacks and breaks markup.
2

HTML Escape →
Paste text containing <, >, &, quotes. The tool replaces them with < > & " ' — safe for both element content and attribute values.
3

HTML Entity Encoder →
For full Unicode entity encoding (not just the five specials), use this tool to convert all non-ASCII characters to numeric entities as well.
4

HTML Entity Decoder →
Reverse the process: paste entity-encoded text to recover the original characters for display or editing.

Frequently asked questions

What is the difference between html-escape and html-entity-encode?: html-escape only converts the five HTML-special characters (< > & " '). html-entity-encode converts all non-ASCII characters to numeric entities too, producing fully ASCII-safe output.
Is escaping enough to prevent XSS?: Escaping prevents XSS when inserting text into element content or quoted attributes. It is NOT sufficient for unquoted attributes, URL attributes (use url-encode), or script/style contexts — those need context-specific handling.