🛡️ HTML Escape
Escape and unescape HTML special characters to prevent XSS and display issues.
Escape Reference
| Character | Escaped |
|---|---|
| & | & |
| < | < |
| > | > |
| " | " |
| ' | ' |
❓ FAQ
Characters like <, >, and & have special meaning in HTML and will be interpreted as tags or entities. To display them as literal text, they must be escaped. More critically, failing to escape user input before inserting it into HTML creates XSS (Cross-Site Scripting) vulnerabilities.
XSS (Cross-Site Scripting) is an attack where malicious scripts are injected into web pages. If you output user input without escaping, an attacker can inject <script>alert('hacked')</script>. Escaping turns < into < so the browser renders it as text, not code.
is a Non-Breaking Space — a space character that prevents line breaking at that position. Unlike regular spaces, browsers won't collapse multiple entities into one space, making it useful for precise layout control.
Escape when inserting text into HTML to display it safely. Unescape when you've received HTML-encoded text (e.g., from an API or database) and need to convert it back to readable characters. Never unescape user content and then insert it into the DOM without sanitization.
In HTML attributes, you must escape & and whichever quote character surrounds the attribute value: " for double-quoted attributes, ' for single-quoted. In text content, only & and < are strictly required, though escaping > is recommended for clarity.