HTML entities and escaping: keep markup from breaking
Learn when to turn <, >, and & into entities so user text does not become accidental HTML.
Why escaping matters
Browsers parse < and & specially in HTML. If you paste user content into a page without escaping, you can break layout or open the door to script injection.
Entities you will see often
< > & and " appear in templates, emails, and CMS fields. Decoding converts them back to readable characters when you need the original text.
Defense in depth
Client-side entity encoding helps while drafting. Production apps still need correct escaping in the framework you use, plus a content security policy where appropriate.
Try related tools
- HTML entities — Encode special characters to entities and decode them back.
- JSON formatter — Beautify, minify, and validate JSON in the browser.