&;HTML Entity

HTML Entities: Complete Guide

HTML entities safely represent characters with special meanings in HTML (<, >, &, "). Essential for preventing XSS (Cross-Site Scripting) when rendering user input, or for displaying raw HTML source on screen without it being parsed as markup.

Named Entity vs Numeric Entity

HTML entities come in two forms. Named references (&) are human-readable. Numeric references (& decimal or & hex) work in every parser and environment. HTML5 supports both; some named references are not recognized in XML parsers.

Common HTML Entities Reference

Using HTML Entities to Prevent XSS

XSS (Cross-Site Scripting) injects malicious scripts into HTML. Putting raw user input into innerHTML lets attackers execute <script> tags. Encoding to HTML entities makes the browser treat the content as text, not markup.

• Always encode user input before inserting into HTML (most important rule)
• Use textContent instead of innerHTML when possible (auto-escapes)
• Each context needs its own encoding: HTML body, attributes, JS, CSS, URL
• Add CSP (Content Security Policy) headers to block inline scripts

How to Use

1. Encode mode: paste text to convert into HTML entities for safe insertion.
2. Decode mode: paste entity-encoded HTML to restore the original characters.
3. Toggle the Named refs option to choose between & and & style output.