HTML Entity Encoder

Five characters carry meaning

In HTML, the ampersand, less-than, greater-than, double quote and single quote have structural meaning. Text containing them must be encoded or the browser interprets them as markup rather than content. Encoding the ampersand first is essential, because encoding it after the others would double-encode the entities you just created.

Context decides the escaping

HTML entity encoding is correct for text inside an element and inside a quoted attribute value. It is the wrong escaping everywhere else. Inside a script block you need JavaScript string escaping; in a URL you need percent-encoding; in a CSS value you need CSS escaping. Applying HTML encoding to a value that lands in a JavaScript context does not make it safe, and this mistaken sense of safety is a common source of cross-site scripting.

Unquoted attributes are dangerous

HTML permits attribute values without quotes, and in that context a space or a slash terminates the value, so entity-encoding the five usual characters is not sufficient to contain an injected payload. Always quote attribute values. It costs two characters and removes an entire vulnerability class.

Named, decimal and hex

The same character can be written three ways: a named entity, a decimal numeric reference, or a hexadecimal one. Named entities are readable but only around 250 exist; numeric references cover every Unicode code point. For anything beyond the common set, numeric is the reliable choice.

Encoding is not sanitising

Encoding renders text inert so it displays literally. Sanitising removes dangerous constructs while keeping some markup functional. If you want users to submit formatted content, you need a sanitiser with an allowlist, not an encoder. Encoding user HTML makes the tags visible as text, which is safe and usually not what was wanted.

Encode on output, not input

Store the raw value and encode when rendering, because the correct encoding depends on the destination. Encoding at input locks the data to one context, corrupts it for every other use, and produces the double-encoded text that shows up as visible entity codes on a page.