HTML Entity Escape and Unescape

How to use it

1. 1Paste your text into the box marked "Text or markup to escape"Paste the text or markup. Escape and Unescape switch direction. Everything happens inside your browser — nothing is uploaded, so there is nothing for us to store, log or lose.
2. 2Read the result as it updatesThere is no button to press. The conversion happens as you type. The output recomputes every time you change the text or one of the options above it.
3. 3Escape when you are putting text INTO a pageIt turns < > & " into their entities so they display as characters rather than being parsed as markup. This is the operation that stops somebody else's text becoming somebody else's HTML.
4. 4Unescape when you are reading markup OUTIt turns &amp;amp; and &amp;#160; back into the characters they stand for — useful when a value has been escaped twice on its way through a system.
5. 5Do not treat escaping as sanitisingEscaping makes text safe to DISPLAY. It does not make untrusted HTML safe to insert into a page — that needs an allowlist sanitiser, which this is not.
6. 6Copy or download the resultThe buttons under the output put it on your clipboard or save it as a file, and each one says exactly what it will copy or download. Any note about something the tool changed or deliberately left alone is shown with the result rather than hidden.

About this tool

HTML entity escaping replaces the five characters that carry meaning in HTML — & < > " ' — with their entity forms, so that text is displayed as text rather than interpreted as markup. It is the mechanism behind preventing cross-site scripting when user content is rendered into a page.

Unescaping goes the other way, turning &amp;, &#8212; and &#x2014; back into the characters they stand for. It is what you need when a feed, an export or a database column has been escaped twice and now shows &amp;amp; on screen.

Understanding the result

Escaping converts & first and the rest after, which is the order that avoids double-escaping the ampersands it has just introduced.

The apostrophe is written as &#39; rather than &apos;. &apos; is not defined in HTML 4 and older parsers display it literally.

Unescaping handles named entities, decimal (&#169;) and hexadecimal (&#xA9;) forms. Anything it does not recognise is left exactly as it was rather than guessed at.

Example

<a href="?a=1&b=2">Tom & Jerry's</a>

<a href="?a=1&b=2">Tom & Jerry's</a>

Limitations

• Escaping text is not by itself sufficient protection against XSS. Content placed inside a script tag, a style block, an event handler attribute or a URL attribute needs the escaping rules for that context, not this one.
• The named-entity table covers the entities that appear in real documents, not all 2,231 in the HTML standard. The numeric forms are handled completely, and the long tail almost always arrives numeric.
• This tool does not parse HTML. It escapes and unescapes characters; it will not tell you whether your markup is well formed.
• Decoding is deliberately not done by assigning to innerHTML — the usual shortcut — because that executes scripts in the pasted markup. That is why the entity table exists.

Questions