HTML entity encoder

HTML entities let you write characters that would otherwise be interpreted as markup, or that are hard to type. < renders as a literal less-than sign instead of opening a tag.

The five that matter

&, <, >, " and '. Escaping these before inserting user content into a page is the foundational defence against cross-site scripting. Everything else is convenience.

Escaping is context-dependent

HTML-escaping is correct inside element content and attribute values. It is not sufficient inside a <script> block, a URL, or a CSS value — each needs its own escaping. This is why hand-rolled escaping keeps producing vulnerabilities, and why templating engines that escape by context are worth using.

Named, decimal and hex

©, © and © all produce ©. HTML5 defines over two thousand named entities; numeric references work for any code point and need no lookup table.

You usually do not need entities for accents

With a UTF-8 charset declared — which every modern page has — you can write café directly. Entities for accented characters are a holdover from the days of ambiguous encodings.