jsonecho

HTML Escape

Paste your text and get it escaped for HTML, ready to paste into code or data.

Loading the tool...

How to use HTML Escape

  1. Paste or type the text you want to escape.
  2. Adjust the options if you need to.
  3. Copy the escaped result.

About HTML Escape

HTML gives five characters a special meaning: the ampersand, the two angle brackets and both kinds of quote. If any of them appears in text you want to show on a page, the browser reads it as markup. A "less than" sign in a sentence can swallow the rest of the line, and a stray quote can end an attribute early. Escaping replaces each of those with an entity, such as < for the opening bracket.

This is also your first line of defence against cross-site scripting. Any text that comes from a user and ends up in a page has to be escaped for HTML, either by your template engine or by hand.

What gets escaped

& becomes &amp;, < becomes &lt;, > becomes &gt;, a double quote becomes &quot; and a single quote becomes &#39;.

Frequently asked questions

Which characters does HTML escape cover?

The ampersand, less-than, greater-than, double quote and single quote. Those five are enough to make text safe inside element content and inside quoted attribute values.

Is escaping enough to prevent XSS?

It is the right fix for text placed in element content or in a quoted attribute. It does not cover every context. Text placed inside a script block, a URL or a style needs different handling.

Why is the single quote written as ' and not '?

' is not defined in HTML 4 and some older browsers ignore it. The numeric form works everywhere.

What does "Encode non-ASCII" do?

It writes every character outside plain ASCII as a numeric entity, for example é becomes é. Use it when the page or the channel cannot be trusted to carry UTF-8.

More in Escape and Text

All tools →