HTML Escape — Complete Guide
HTML escaping converts special characters into their HTML entity equivalents so they display correctly in a browser without being interpreted as HTML markup. The five characters that must always be escaped are: less-than (becomes <), greater-than (becomes >), ampersand (becomes &), double quote (becomes "), and single quote (becomes ').
This is a fundamental security practice. If user input is displayed in a web page without escaping, an attacker can inject HTML or JavaScript into your page — a vulnerability called Cross-Site Scripting (XSS). Always escape user-provided text before rendering it in HTML.
What you can do with HTML Escape
- Safely displaying user-submitted content in HTML without XSS risk
- Preparing text snippets to embed inside HTML attributes
- Showing HTML source code as visible text on a web page
- Encoding strings for use in HTML templates and email bodies
- Sanitizing content before inserting it into the DOM
How to use HTML Escape
Paste the text that contains special characters into the input field
The HTML-escaped version is generated instantly
Copy the output and use it safely inside HTML contexts
Tips for best results
Always escape user input before rendering it in HTML — never trust input from external sources
Most web frameworks (React, Django, Rails, etc.) escape HTML automatically when you use template syntax correctly — problems arise when you explicitly bypass this with things like innerHTML
The & character must be escaped first — otherwise escaping < produces < and then escaping that & could double-escape it
Other tools you might find useful
Frequently asked questions
What is XSS and why does HTML escaping prevent it?
Cross-Site Scripting (XSS) is an attack where malicious scripts are injected into a page and executed in other users' browsers. HTML escaping prevents this by converting < and > into entities that browsers display as text rather than interpreting as tags.
Do I need to escape HTML if I'm using React?
React escapes values automatically when you use JSX expressions like {userInput}. The risk comes from explicitly using dangerouslySetInnerHTML, which bypasses this protection. Avoid it unless you have sanitized the HTML yourself.
Is HTML escaping the same as URL encoding?
No. HTML escaping converts characters for safe use inside HTML documents. URL encoding (percent-encoding) converts characters for safe use inside URLs. They use different character sets and replacement formats.