HTML Entity Encoder
Convert the five characters that break HTML — & < > " ' — into their entity forms, safely and instantly.
Frequently asked questions
Why does & alone need escaping?
Because & begins every entity reference. If the parser sees & followed by something that looks like an entity, you get subtle rendering bugs. Escaping every & to & is the only always-correct move.
Should quotes be escaped in text content?
In regular text, quotes are harmless. Inside attribute values — alt="..." title="..." — an unescaped quote terminates the attribute early, which is both a validity bug and an XSS vector. Escaping them is a good default habit.
Does escaping prevent XSS?
Escaping the five special characters is precisely what output encoding means, and it neutralizes the classic injection of <script> into generated HTML. Always escape on output, and let a framework's auto-escaping do the heavy lifting where possible.