HTML Encode

What HTML Entities Are and Why They Exist

An HTML parser reads a document looking for structure. When it sees a less-than sign it assumes a tag is starting, and when it sees an ampersand it assumes an entity reference is starting. If your content genuinely contains those characters as text, the parser has no way to tell the difference, and your paragraph about "a < b" silently becomes a malformed element.

Entities solve this by giving every problem character an alternative spelling that contains no structural characters. An entity begins with an ampersand, names the character either by keyword or by code point number, and ends with a semicolon. The parser resolves it back to the original character at the moment it builds the text node, so the reader sees exactly what you intended.

The Characters You Must Escape

Five characters do the damage. Two of them, the ampersand and the less-than sign, are dangerous anywhere in an HTML document. The others matter depending on where the text lands.

Order is not optional. If you escape the less-than sign before the ampersand, the ampersand you just introduced gets escaped again and < turns into &amp;lt; which renders as visible text rather than a symbol. Always replace the ampersand first, then everything else.

Escaping and Cross-Site Scripting

Escaping user input before it reaches a page is the primary defence against cross-site scripting. An attacker who can get raw markup into your HTML can run JavaScript in your users' sessions. Encoding removes the ability of the input to change the shape of the document.

The critical subtlety is that escaping is context dependent. There is no single correct encoding, only the correct encoding for the place the value lands:

• HTML body. Escape the five characters above. This is what an HTML encoder does.
• Attribute value. Escape the same set and always quote the attribute. An unquoted attribute can be escaped by a space alone.
• Inside a script block. HTML escaping does not help. You need JavaScript string escaping, and the safest approach is to serialise the value as JSON rather than interpolating it.
• Inside a URL attribute. Percent-encode the value and validate the scheme, since javascript: URLs survive HTML escaping untouched.
• Inside CSS. CSS has its own escaping rules and its own injection vectors. Prefer not to interpolate user data into styles at all.

Named, Numeric, and Hexadecimal Entities

The same character can be written three ways. All three render identically, and the choice is about readability and compatibility.

XML predefines only five names (amp, lt, gt, quot, apos), so anything generating XML, RSS, or SVG should prefer numeric references. Note also that &apos; was added in HTML5 and is unreliable in very old HTML4 parsers, which is why security libraries tend to emit &#39; for the apostrophe instead.

HTML Entity Reference Table

Named entities are easier to read, numeric entities work everywhere including XML where only five names are predefined. Both forms always end with a semicolon.