HTML gives a handful of characters special meaning: they mark up the page rather than displaying as text. If you want to show those characters rather than use them, you must escape them into entities. Get it wrong and a page either renders strangely or becomes a security hole.
Why escaping exists
The angle brackets < and > start and end tags. If a commenter types <b>hello</b>, the browser will make the text bold instead of showing the literal tag. Escaping converts the markup characters into codes the browser displays as plain text.
The core escape map
| Character | Entity | Why escape it |
|---|---|---|
& (ampersand) | & | Starts every entity; must be escaped first. |
< (less than) | < | Could start a tag. |
> (greater than) | > | Ends a tag. |
" (quote) | " | Ends an HTML attribute value. |
' (apostrophe) | ' | Ends an attribute value using single quotes. |
The ampersand comes first for a reason: if you escape it after the others, you would corrupt the very entities you just created, turning < into &lt;.
Named vs numeric entities
The same character can be written several ways:
- Named:
<,>,&, . Readable, but not every character has a name. - Decimal numeric:
<for<, for a non-breaking space. - Hexadecimal numeric:
<for<, for a non-breaking space.
All three refer to the same code point. Named entities are easier for humans; numeric forms work for any character, including emoji and rare symbols that have no name.
A before-and-after example
Raw text a user typed:
5 < 6 & 7 > 6 — she said "hi"Escaped for safe display inside HTML:
5 < 6 & 7 > 6 — she said "hi"The browser shows the first line to the reader. The second line is what actually sits in the page source, so the symbols are displayed instead of being interpreted.
Context matters
Escaping is not one universal rule; it depends on where the text lands:
- HTML text: escape
&,<,>. - HTML attribute: also escape the quote character that delimits the attribute.
- URLs: use percent-encoding instead — a different system. See the URL encoding guide.
- JavaScript strings: escape quotes and backslashes for that language, not HTML entities.
Using the wrong scheme for the context is a common source of bugs. An ampersand in a URL, for instance, should usually be %26, not &.
Common mistakes
- Double escaping. Running an already-escaped string through the encoder again turns
<into&lt;, which the reader then sees literally. - Not escaping user input. Displaying raw user text in a page is how cross-site scripting (XSS) happens; the browser runs what the user supplied if it looks like a tag or script.
- Escaping for storage instead of display. Store the original text and escape at render time, so you never lose the real characters.
- Confusing decoding with trusting. Un-escaping a string tells you what it says; it does not make it safe to inject.
Going the other way
Decoding converts entities back into characters. It is useful when you copy text from page source and want the plain version, or when debugging why a page shows & where you expected &. Paste the text into our HTML encoder / decoder to escape or unescape it in one step. If the content will end up in a data file, the CSV to JSON guide shows how special characters survive that conversion.