HTML Entity Encode/Decode

What HTML entities actually solve

A browser reads certain characters as markup, not text. An angle bracket starts a tag, an ampersand starts an entity, and quotes close attribute values. If you drop raw user input containing those characters into a page, the browser can misinterpret it, break your layout, or run injected script. HTML entity encoding replaces those reserved characters with safe escape sequences so they render as literal text.

The core four are the ones you will use constantly: ampersand becomes &, less-than becomes <, greater-than becomes >, and a double quote becomes ". There are thousands more named entities for symbols and accented letters, plus numeric forms like © for the copyright sign.

Encode vs decode

Encoding goes from readable text to entity form, which is what you do before inserting untrusted content into HTML. Decoding reverses it, useful when you have scraped markup or pulled a value out of a feed that double-escaped it.

Encode
Input:  <script>alert("hi")</script>
Output: &lt;script&gt;alert(&quot;hi&quot;)&lt;/script&gt;

Because the brackets are now entities, the browser prints the text verbatim instead of executing a script tag, which is the whole point of escaping output to prevent XSS.

Decode
Input:  Tom & Jerry — season 1
Output: Tom & Jerry — season 1

Questions people run into

Do I need to encode every character? No. Encode the reserved characters relevant to the context. Inside HTML text the four core entities are enough; inside an attribute value, be sure the quote character is escaped. Over-encoding ordinary letters just bloats the markup.

Is encoding the same as sanitizing? They are different jobs. Encoding makes content safe to display as text. Sanitizing strips or allows specific tags when you actually want to render some HTML. If you only need to show user text, encoding is the simpler and safer choice.

Why did my text turn into &? That is double encoding: something escaped an already-escaped string. Decode once to recover the original, and make sure only one layer of your stack is responsible for encoding.