How to encode HTML entities correctly

Characters that usually need escaping

In HTML text, ampersands and less-than signs can begin syntax. In quoted attributes, the matching quote character also matters. A practical encoder may escape &, <, >, double quotes, and single quotes.

The browser then displays the angle brackets as text instead of interpreting them as an element.

How to encode an HTML entity

1. Identify the destination: HTML text or a quoted attribute.
2. Choose special-character mode for normal escaping.
3. Choose all-character mode only when decimal references for every code point are specifically required.
4. Paste the original text and select Encode entities.
5. Insert the result into the intended HTML context and test it.

Selective versus all-character encoding

Encoding every character does not add security. It mainly makes source harder to read and increases its length.

Avoid double encoding

If already encoded text such as & is encoded again, its ampersand becomes &. The browser displays & rather than the intended ampersand.

Keep data unescaped internally and encode once at the output boundary. This makes it easier to choose the correct rules for each destination.

HTML escaping has a context

• HTML entity encoding is not JavaScript string escaping.
• It is not CSS escaping or percent-encoding for URLs.
• It does not sanitize a complete HTML document.
• Unquoted attributes have additional parsing risks and should generally be avoided.

The ToolPixels encoder is intended for HTML text and quoted attributes. Use a context-aware library when constructing complex markup in an application.

Use HTML Entity Encoder in your browser

Encode HTML-sensitive characters or every Unicode code point locally, then copy the plain-text result.

Encode HTML entities