HTML Entity Converter escape
Escape HTML special characters into entities or convert entities back to their original characters.
What this tool does
In an HTML document the characters <, >, &, and quotation marks carry structural meaning. Placing them raw into page content makes the browser treat them as markup, which breaks the layout or, far worse, allows user-supplied text to execute as script. That is the basic mechanism behind cross-site scripting.
Entity conversion replaces those characters with alternatives such as <, >, &, and " so the browser renders them as plain text instead of markup. Escaping output is a required step whenever user input is displayed, and it is what functions such as htmlspecialchars in PHP or the textContent property in JavaScript do for you.
The tool also converts in the opposite direction, which is useful when scraped pages, XML responses, or RSS feeds leave entities in the text, including double-encoded forms such as &quot;.
When to use it
Use it to confirm that comment or board input is escaped correctly, to clean up entities left in scraped text, to prepare values containing special characters for an email template or XML document, or to work out what a user actually submitted when a log shows something like <script>.
Input and output examples
<a href="x">A & B</a>
<a href="x">A &amp; B</a>
Tag characters, quotes, and ampersands all become entities and render as text.
<strong>bold</strong>
<strong>bold</strong>
Decoding direction, used to recover original markup from scraped data.
Notes and limitations
Entity escaping protects values placed into HTML body content. If the value lands inside a tag attribute, inside JavaScript code, or inside a URL, that context needs its own escaping rules, so this conversion alone does not prevent every form of XSS. Escaping an already escaped string produces double encoding such as &lt;, which makes the raw entity visible on the page.
Frequently asked questions
Does escaping alone stop XSS?
It is effective for values rendered as HTML body content, but attributes and JavaScript contexts require their own escaping rules. Match the escaping to the output context.
The page shows < literally.
The value was escaped twice, turning & into &amp;. Check that escaping is not applied at more than one layer.