HTML Entity Encoder / Decoder

Why Encode HTML Entities?

Encoding HTML (also known as escaping HTML) converts characters like <, >, and & into their corresponding HTML entities (<, >, &). This is necessary when you want to display HTML code snippets on a webpage without the browser interpreting them as actual code, and it is a fundamental practice for preventing Cross-Site Scripting (XSS) attacks.

Common HTML Entities Reference

Here are the most frequently used HTML character entities:

HTML Encoding and XSS Prevention

Cross-Site Scripting (XSS) is one of the most common web security vulnerabilities. It occurs when an attacker injects malicious scripts into a webpage that other users view. The primary defense is to always encode HTML entities before inserting any user-supplied data into a web page. For example, if a user enters <script>alert('XSS')</script> in a form, it must be encoded to <script>alert('XSS')</script> before being displayed.