HTML Entity Encoder/Decoder

HTML entities represent characters that have special meaning in HTML. The five critical ones: &amp; (&), &lt; (<), &gt; (>), &quot; ("), &apos; ('). Without encoding, user-supplied text containing < or > would be interpreted as HTML tags, enabling XSS attacks. Entities also display special characters like © and — not on standard keyboards.

Named entities use a mnemonic: &amp; for &, &copy; for ©. Numeric entities use the Unicode code point in decimal (&#38; for &) or hex (&#x26;). Named entities are more readable; numeric entities work for any Unicode character. Both are equivalent and all modern browsers support both.

HTML entity encoding is for text inside HTML documents — escaping characters that have special meaning in HTML. URL encoding (percent-encoding) is for text inside URLs — encoding characters not allowed in URLs (spaces become %20). They are completely different contexts: use HTML encoding inside HTML, URL encoding inside URLs.

HTML entity encoding prevents XSS when applied correctly in the right context. Encoding < to &lt; in HTML body content prevents script injection. Context matters: encoding is different for HTML attributes, JavaScript strings, CSS values, and URLs. A full XSS prevention strategy requires context-aware encoding.