HTML Entity Escape
| Character | Named Entity | Decimal | Hexadecimal | Description |
|---|
Tool Description
This tool is an online HTML entity escape/unescape tool that helps developers quickly convert HTML special characters to entity encoding, or restore entity encoding to original characters. Commonly used to prevent XSS attacks, handle rich text content, and safely transfer data between different encoding environments.
What is an HTML Entity?
An HTML entity is a way to represent special characters in HTML documents. Since some characters in HTML (such as <, >, &, etc.) have special meanings, outputting them directly can cause parsing errors or security vulnerabilities, so they need to be replaced with specific entity encoding. Entity encoding supports three forms: named entities (such as <), decimal entities (such as <), and hexadecimal entities (such as <).
Five Most Common HTML Special Characters
<— Less-than sign <, the starting character of HTML tags, must be escaped.>— Greater-than sign >, the ending character of HTML tags, must be escaped.&— Ampersand &, the starting character of entity encoding, must be escaped."— Double quote ", must be escaped in attribute values.'— Single quote ', recommended to escape in attribute values.
Main Use Cases
- Prevent XSS attacks: Escape HTML special characters from user input before outputting to the page.
- Display HTML code in code: Escape HTML tags and display them as example code.
- Handle rich text content: Escape editor content before storing in the database.
- Parse entity-encoded data returned by APIs and restore it to readable content.
Tool Features
- Bidirectional conversion: Supports HTML escaping (encoding) and unescaping (decoding).
- Three modes: Minimal escape, full escape, and named entity modes available.
- Real-time preview: Escaped HTML code can be rendered in real time to view the effect.
- Reference table: Built-in common HTML entity reference table for easy lookup.
- Two-column layout: Input and output displayed separately for more intuitive comparison.
- Safe and reliable: Pure front-end execution, no data uploaded, absolutely protects your data privacy.