PRACTICAL GUIDES · Web and codes
HTML special characters: when to escape text
Separate text from markup, avoid double encoding and understand why HTML entities cannot replace sanitization.
By Puffinmint · Updated
Separate text from HTML delimiters
In HTML, ordinary text and tag delimiters play different roles. To display a literal less-than sign or ampersand in text, use appropriate character references. The destination context determines the protection needed.
Encode once for the correct context
Encode text once at the point where it is inserted. To display a string containing tags, encode the delimiters too. If a template engine already escapes the text, another encoding pass may show entity names to the reader.
-
Input
A & B -
Calculation steps
Choose and apply the method
-
Result
A & B
TRY THIS STEP
HTML entity encoder and decoder
Work inside this guide: load an example, run the tool and edit the inputs to compare results. The second experiment tests a different case.
A reproducible example
The string A & B contains an ampersand. Encoding produces A & B. The sequence &lt; needs two decoding passes to become a less-than sign: this tool performs one pass and returns <.
Decode just one layer
The second example starts with &lt;. One decoding must return <, not a less-than sign. Decode that result again to see the difference between one pass and two.
Result
Enter your values to see the result.
Ampersands and encoding layers
The string A & B contains an ampersand. Encoding produces A & B. The sequence &lt; needs two decoding passes to become a less-than sign: this tool performs one pass and returns <.
Usage scenario
- Input
A & B- Result
A & B
Escaping, sanitization and untrusted input
Decoding does not establish trust. Keep the result as text when it should not become markup. HTML entities are not sanitization and are not a general defense for JavaScript, CSS or URLs; each context requires its own handling.
These are example inputs, rather than measurements of a real case. Results use the full tool’s calculation engine. Compare them with the worked steps in this guide, then tick the checks after reviewing.
| Parameter | Value |
|---|---|
| What are the limits of this tool? | At most 100,000 characters. Decodes one layer and returns text; it does not sanitize HTML. |
| Processing and privacy | Inputs and results are processed in your browser and are not sent to the server. Aggregate statistics, when enabled, record only the tool and outcome, without the content. |