HTML entity encoder
Escape text so it shows as text in HTML, or turn HTML entities back into characters.
Frequently asked questions
Which characters must be escaped in HTML?
Always & and <; inside attribute values also " (or ' if the attribute uses single quotes). > is usually safe but escaping it does no harm.
Should I encode every non-English character?
Not with UTF-8 pages, which is almost every page today: write “é” or “€” as they are. Encoding all non-ASCII characters is only useful for systems that cannot handle UTF-8.
Is escaping enough to stop XSS?
Escaping text before putting it into HTML is the core defence, but the right escaping depends on where it goes (HTML text, attribute, URL, JavaScript). Use your framework’s templating, which escapes for you.