IT Market
Tools/Code/Data/HTML Entity Encoder Online — Escape HTML
HTML Entities Encode

Кодируйте HTML сущности

Tool guide

HTML Entity Encoder Online — Escape HTML

For a snippet of markup to show up as text rather than turn into elements, its special characters have to become entities: angle brackets, the ampersand and both kinds of quote. This tool does that swap, handing you a string you can drop into an article, a product card, an email template or a CMS field without it rendering. The same substitution is the backbone of XSS defence when user input is echoed back to a page. See also: unescape entities back to readable text, clean a fragment down to plain text, render HTML from a Markdown draft.

How to use it

  1. Paste the snippet or the text containing brackets and quotes into the «Text Input» box.
  2. Press «Encode» and the special characters appear as entities in «Encoded Output».
  3. Check the result: a tag should read <div> and a bare ampersand should read &.
  4. Press «Copy» and paste the safe string into your article, email template or CMS field.
  5. «Clear» empties both boxes when the next snippet is ready to go.

FAQ

Which characters actually need escaping in HTML?

Three matter in page text: the ampersand, less-than and greater-than. Inside an attribute value you must add both quote characters, otherwise the value closes early and whatever follows becomes part of the tag. Letters, spaces and punctuation need no escaping at all.

How do I put a code sample in an article without it rendering?

Encode the snippet here and paste the result inside a pre and code block. The browser then prints <div> as text instead of building an element. If your CMS editor escapes input on its own, encoding again produces double escaping and readers see < — always check the preview.

Is escaping enough to stop XSS?

For user text printed into the page body it usually is, and it belongs in your server code or template engine rather than a manual paste. Context still decides: inside a script tag, in an href value or in an inline event handler the rules differ and HTML entities alone fall short. This page prepares content; it is not an application security control.

Should non-Latin letters be encoded as П too?

No. Modern pages are served as UTF-8 and carry those letters literally, which keeps the markup shorter and the text indexable. Numeric references for them made sense in the days of mixed code pages and now survive mostly in legacy exports and email templates.

How does this differ from URL encoding?

HTML entities decide how a character is displayed in a document; percent encoding decides how it survives a trip inside an address. A link with parameters needs a URL encoder instead. A string landing in an href sometimes needs both: percent-encode the value, then HTML-escape the whole attribute.

Where is the pasted snippet processed?

The substitution runs in the page script inside your open tab, so an unpublished draft or a customer review is safe to paste — nothing leaves the machine. Both boxes empty on reload, so grab the output with the copy button straight away.

Examples

Code sample inside a blog post
Before: Order & pay
After: <a href="/order">Order & pay</a>
User review before it is echoed to the page
Before: Best price in town
After: Best <b>price</b> in town