Why encode HTML entities?
Some characters have special meaning in HTML. A < starts a tag and & starts an entity, so to display them as text — for example when showing code in a blog post — they must be written as < and &. Escaping user-supplied text before inserting it into a page is also a basic defense against cross-site scripting (XSS).
The five characters you must escape
| Character | Entity | Why |
|---|---|---|
| < | < | Starts a tag |
| > | > | Ends a tag |
| & | & | Starts an entity |
| " | " | Ends a double-quoted attribute |
| ' | ' | Ends a single-quoted attribute |
Named vs numeric entities
Named entities like © are easy to read. Numeric entities like © (decimal) work for every Unicode character, including emoji. Modern pages saved as UTF-8 can include characters like é or © directly, so encoding non-ASCII characters is optional — useful for emails, XML or old systems with unknown encodings.
Decoding
Switch to Decode to turn text full of &, ’ or — often seen in RSS feeds, APIs and scraped content — back into readable characters. For URLs, use the URL encoder; for writing formatted content, try Markdown to HTML.
Frequently asked questions
What is an HTML entity?
A code that represents a character in HTML, such as &lt; for < or &copy; for ©.
Which characters must be escaped in HTML?
< > & always; " and ' inside attribute values.
What is &nbsp;?
A non-breaking space — a space that won’t collapse or wrap onto a new line.
Does encoding prevent XSS?
Escaping text before inserting it into HTML is a key defense, but use your framework’s built-in escaping for complete protection.