Developer
HTML entity encoder / decoder
The five characters that matter are ampersand, angle brackets, double quote and apostrophe. Leave any of them unescaped inside attribute values or text nodes and the markup breaks — usually silently, which is worse than loudly.
How to use it
- Paste the text or markup fragment.
- Press Encode to escape the five special characters.
- Press Decode to turn entities such as & back into plain characters.
- Copy the result into your template or CMS field.
Escaping is not filtering
Escaping converts characters so they are displayed rather than interpreted. Filtering removes content you do not want. They solve different problems: escaping <script> turns it into visible text, which is right for a comment field and wrong for a field meant to accept markup. Confusing the two is the root of most cross-site scripting bugs, because a filter that strips one spelling of a tag passes a dozen others.
Context decides what must be escaped
In an HTML text node, < and & matter. In a quoted attribute, the quote character matters too. In a JavaScript string inside the page, a closing tag is irrelevant but a backslash is not. In a URL, percent-encoding applies instead. No single “escape everything” function is correct in every context, which is why templating engines track the context for you rather than exposing one generic helper.
Double escaping, and how to spot it
If a page shows & where an ampersand belongs, the text was escaped twice: once when stored, again when rendered. Decoding once gives &, which is correct — decoding twice turns a legitimate < into a live <, which is how escaping gets undone by accident.
In general, escape on output, not on input. Storing raw text and escaping at the point it enters HTML keeps the data usable everywhere else; storing escaped text means every consumer has to guess whether it is already encoded.
Frequently asked questions
Which characters are escaped?
Ampersand, less-than, greater-than, double quote and apostrophe. Everything else, including accented letters and Chinese characters, is left as-is because UTF-8 handles them natively.
Why encode the apostrophe numerically?
The numeric form is accepted by every browser and validator. The named ' entity is valid in XHTML and HTML5 but was not in HTML 4, so the numeric form is safer when output may land in older templates.
Is decoding safe for untrusted input?
The decoder returns plain text into a text area — it does not execute scripts or load images, because the markup is parsed as a detached element that is never inserted into the page.
Should I escape text before storing it in a database?
No. Store raw text and escape at render time. Escaping on the way in leads to double-escaped output that nobody can read.
Should I use named entities or numeric ones?
Named where they exist and are well supported (&, <, ); numeric for anything outside ASCII, because named entities do not exist for most characters.
Is the same as a space?
No. It is a non-breaking space: it prevents a line break at that point and is not collapsed by HTML whitespace rules. Using it for layout indentation is a common cause of broken text selection.