Turn text into HTML that displays exactly as written — tags, ampersands and quotes included — or decode a string full of & and ' back to readable characters.
Runs entirely in your browser — nothing you enter here is sent to a server.
Five characters have a meaning in HTML: < and > open and close tags, & starts an entity, and " and ' end attribute values. To show any of them as text, write it as an entity instead — < displays as <, & as &. Every other character can be written as itself in a UTF-8 page, or as a named entity (é) or a numeric one (é) if the page or the tool in between cannot carry it.
Between tags, escaping &, < and > is enough. Choose "For text content".
Inside title="…" or value="…", quotes must be escaped as well, or the value ends early. The default option covers both.
Named entities are easier to read; numeric ones work for every Unicode character and in XML, which knows only five names.
A non-breaking space: it looks like a space but stops a line break and is not collapsed. Pasted text from Word and e-mail is full of them.
Cross-site scripting happens when a page puts text from a user into HTML without escaping it, so <script> in a comment becomes a real script. Encoding the five unsafe characters at the point where text is written into HTML turns any markup into harmless text. Templating engines do this for you by default — the risk comes from the places that bypass it, like innerHTML, |safe filters and string concatenation.
Escaping depends on where the text goes. HTML entities protect HTML text and quoted attributes; inside a <script> block, a URL or CSS you need JavaScript string escaping, URL encoding or CSS escaping instead.
Always & and <; > is escaped by convention. Inside attribute values also the quote that delimits the value — escaping both " and ' covers every case.
Both are an apostrophe. ' was not defined in HTML 4, so older browsers did not know it; ' works everywhere, which is why most escaping functions use it.
The text was escaped twice — for example once when it was saved and again when it was displayed. Decode it, then make sure it is escaped only once, at output.
No. Entities are decoded by the browser's own parser inside a text box, which never renders markup or runs scripts, so pasted code is safe to decode here.
Upzilla checks your sites, servers and APIs around the clock and alerts you the moment something breaks. 10 monitors free, no card required.