Why HTML Encoding Matters
HTML encoding converts characters that have special meaning in HTML (<, >, &, ", ') into entity references (<, >, &, etc.). This prevents XSS attacks and rendering bugs when displaying user-generated content in web pages.
Every time you insert untrusted content into HTML — user comments, form submissions, API data, database values — it must be HTML-encoded first. Without encoding, a user could inject <script> tags that execute arbitrary JavaScript in other users' browsers. This is Cross-Site Scripting (XSS), one of the most common web vulnerabilities.
Our encoder handles named entities (like © for ©) and numeric entities (like ©). Non-ASCII characters are converted to numeric entities for maximum compatibility across email clients, older browsers, and systems that don't support UTF-8.
Tips
- The five critical characters to always encode:
&→&,<→<,>→>,"→",'→'. - Modern frameworks (React, Svelte, Vue) auto-encode by default. Manual encoding is needed for raw HTML insertion (
innerHTML,{@html}). - For email templates, encode all non-ASCII characters as numeric entities — email client Unicode support is inconsistent.
- Use
(non-breaking space) to prevent line breaks between words that should stay together.