&;HTML Entity
Encode/decode HTML entities
HTML Entity Encoder/Decoder Guide
HTML entities safely represent characters with special meanings in HTML (<, >, &, "). Essential for preventing XSS when rendering user input, or displaying raw HTML source on screen.
Common Entities
| Char | Named | Numeric | Use |
|---|---|---|---|
| < | < | < | Tag start |
| > | > | > | Tag end |
| & | & | & | Entity start |
| " | " | " | Attribute |
| ' | ' | ' | Attribute |
| space | |   | Non-breaking |
| © | © | © | Copyright |
| ® | ® | ® | Trademark |
| € | € | € | Euro |
XSS Prevention Best Practices
- Always encode user input before output
- Use context-appropriate encoding: HTML, attribute, JS, CSS, URL
- Prefer textContent over innerHTML when possible
- Add Content Security Policy (CSP) headers