HTML Entity Encode & Decode
Escape and unescape HTML special characters
How it works
Certain characters have special meaning in HTML. Encoding &, <, >, " and ' as entities (like & and <) lets you display them literally and helps prevent cross-site scripting when injecting user content. Decoding converts named and numeric entities back to characters.
Frequently asked
Which characters get encoded?
The five HTML-significant characters: & < > " and '. Decoding also understands numeric entities such as © and 😀.
Does this prevent XSS by itself?
Entity-encoding untrusted text before inserting it into HTML is an important defense, but full XSS protection depends on context (attributes, scripts, URLs). Use a framework's escaping where possible.