HTML Entity Encoder
Escape the five common HTML-sensitive characters in a text snippet. Prepare literal angle brackets, ampersands and quotes for display rather than markup interpretation.
- Escape ampersands and angle brackets
- Encode single and double quotes
- Keep ordinary text readable
Display markup as text
Encode a snippet such as <strong>hello</strong> before placing it in an HTML text context. Its brackets become entity references.
Protect the ampersand
Ampersands are encoded along with brackets and quotes. That keeps existing entity-like text from being interpreted as a new character reference.
Know the escaping context
HTML escaping is not JavaScript, CSS or URL escaping. Use the correct protection for the destination where your text will be inserted.
Keep sanitizing separate
The encoder does not inspect allowed tags or remove dangerous attributes from HTML. It escapes text rather than sanitizing an HTML document.
HTML Entity Encoder FAQs
No. It targets five HTML-sensitive characters and leaves other Unicode text intact.
Its ampersand was encoded too. Start with the original unescaped text when only one escaping pass is needed.
Encode the snippet to <p>Hello</p> before placing it in an appropriate HTML text context. This is text escaping, not a general sanitizer. JavaScript, CSS and URL contexts have different escaping requirements.