Escape HTML
Make any text safe to put inside HTML, so it is shown as written instead of being read as markup.
Text
Encoded
Escape HTML Online
Showing code in a blog post, putting a product name into a template or displaying what a user typed all need the same step: turning the characters that HTML treats as syntax into entities. This page opens the HTML Entity Encoder in encoding mode with a sample.
Before and after
| Text | Escaped |
|---|---|
<p>Hello</p> | <p>Hello</p> |
Tom & Jerry | Tom & Jerry |
say "hi" | say "hi" |
Escaping in code
| Language | Function |
|---|---|
| PHP | htmlspecialchars($s, ENT_QUOTES) |
| Python | html.escape(s) |
| JavaScript (DOM) | set textContent instead of innerHTML |
| Templates | Twig, Jinja, Blade and React escape output by default |
If your template engine already escapes output, do not escape the text again first, or visitors will see &amp; instead of &.
Related tools
To reverse the process, use decode HTML entities. For text going into a URL rather than a page, use the URL encoder.