HTML Entities

HTML entities are character references such as & or ' that let markup represent reserved characters and selected Unicode values. Encoding turns text into a form that can be displayed without being interpreted as tags, while decoding turns references back into characters. Entity conversion is a presentation operation, not a complete XSS defense; the correct escaping context depends on whether the value enters HTML, an attribute, JavaScript, CSS, or a URL.

Encode untrusted text for the exact output context and avoid concatenating user content into raw markup. Verify that quotes, angle brackets, ampersands, and apostrophes are handled according to the renderer's rules. Do not decode an untrusted string and then insert it with innerHTML. Prefer framework escaping and a trusted sanitizer for rich text, and treat an entity encoder as a debugging and inspection utility rather than a replacement for a content security policy.

Markup fragments and error messages can include private data, so converting them locally avoids an unnecessary upload. Immediate feedback helps when debugging double-encoding, a broken template, or an API response that displays literal entities. The browser result should be tested in the same rendering context as production because an entity that is safe in text content may behave differently in an attribute or URL. Keep the trust boundary explicit.