HTML Escape & Unescape – HTML Entities

Why escaping matters

If user input is inserted into a page without escaping, it becomes part of the HTML. This input closes an attribute and injects an image whose error handler runs JavaScript, a classic cross-site scripting (XSS) attack:

Unescaped input inside value="…"

<input value=""><img src=x onerror=alert(1)>">

Escaped

<input value="&quot;&gt;&lt;img src=x onerror=alert(1)&gt;">

After escaping, the browser shows the input as text in the field, and no script runs.

Common HTML entities

Character	Entity	Description
&	`&`	Ampersand
<	`<`	Less than
>	`>`	Greater than
"	`"`	Double quote
'	`'`	Apostrophe (' in HTML5 and XML)
	` `	Non-breaking space
©	`©`	Copyright
®	`®`	Registered
™	`™`	Trademark
—	`—`	Em dash
–	`–`	En dash
…	`…`	Ellipsis
“	`“`	Left double quote
”	`”`	Right double quote
‘	`‘`	Left single quote
’	`’`	Right single quote, apostrophe
«	`«`	Left angle quote
»	`»`	Right angle quote
•	`•`	Bullet
·	`·`	Middle dot
€	`€`	Euro
£	`£`	Pound
¥	`¥`	Yen
°	`°`	Degree
±	`±`	Plus-minus
×	`×`	Multiplication
÷	`÷`	Division
→	`→`	Right arrow
←	`←`	Left arrow
✓	`&check;`	Check mark

Pages served as UTF-8 (the default for HTML5) can contain characters like é, — and € directly. You only need entities for the special characters above, or when a system can’t handle UTF-8; then turn on Encode non-ASCII.

Escaping HTML in code

JavaScript

const escapeHtml = (s) =>
  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
   .replace(/"/g, '&quot;').replace(/'/g, '&#39;');

// In the DOM, textContent never interprets HTML, so no escaping is needed
element.textContent = userInput;

Python

import html

html.escape('<a href="x">Tom & Jerry</a>')   # quotes escaped by default
html.unescape('caf&eacute; &amp; cr&egrave;me')  # 'café & crème'

import "html"

html.EscapeString("<b>Tom & Jerry</b>")
html.UnescapeString("&lt;b&gt;")

Frameworks like React, Vue, Angular, Django and Jinja escape values automatically. You only need manual escaping when building HTML strings yourself, or when using escape hatches like dangerouslySetInnerHTML or |safe. Escaping for a URL instead? Use the URL encoder.

Frequently asked questions

What does escaping HTML mean?

Escaping replaces characters that have a special meaning in HTML with entities, so they are shown as text instead of being interpreted as markup. < becomes <, > becomes >, & becomes &, and in attribute values " becomes ". The browser displays the original characters.

Which characters must be escaped in HTML?

In text content, & and < must be escaped; > is escaped by convention. Inside an attribute value, also escape the quote character that surrounds it: " for double-quoted attributes, ' for single-quoted ones. Escaping all five (& < > " ') is safe in both places, which is the default here.

Does escaping HTML prevent XSS?

For text content and quoted attribute values, yes: escaped input cannot open a tag or break out of an attribute. It is not enough for other contexts. URLs in href or src need validation (escaping doesn’t stop javascript: links), and values inside <script> blocks, inline event handlers or CSS need their own encoding. Prefer a template engine that escapes automatically.

What is the difference between   and a normal space?

A non-breaking space ( , U+00A0) looks like a space but prevents a line break at that position and is not collapsed with neighbouring spaces. Use it between values that belong together, like 10 km. It is a common source of bugs when text is copied into code, because it doesn’t match a regular space.

How do I decode HTML entities?

Switch the tool to Unescape and paste the text. It uses your browser’s HTML parser, so all named entities (é, —, … and the other 2,000+), decimal references like é and hex references like é are decoded exactly as a browser would.