HTML Entities Explained: Escaping Text Safely for the Web
Learn when to encode HTML characters and why escaping is one small part of a safer rendering strategy.
HTML uses characters such as angle brackets, quotes, and ampersands as syntax, which creates a problem when those characters are meant to appear as ordinary text. Entities provide a readable encoded form so text can be displayed without being interpreted as markup.
The most common examples are < for a less-than sign, > for a greater-than sign, and & for an ampersand. Quotes may need encoding inside an HTML attribute, especially when the surrounding attribute uses the same quote character.
Use /tools/html-entity-encoder when you need to prepare a small markup example for documentation or inspect encoded content from a feed. It is also useful for decoding a snippet so you can tell whether you are looking at literal text or escaped markup.
Encoding is not a replacement for a secure rendering model. Do not concatenate untrusted input into HTML strings and assume entities solve every context; JavaScript, CSS, URLs, and HTML attributes each have different escaping and validation requirements.
Modern frameworks often escape text nodes automatically, which is a good default. Problems usually begin when an application bypasses that protection with raw HTML, so reserve that capability for trusted, sanitized content with a clearly understood source.