Which characters must be escaped to prevent Cross-Site Scripting (XSS)?

The five essential XML/HTML characters that must always be escaped in untrusted user input before rendering in HTML context are: ampersand ('&' to '&'), less-than (' ' to '>'), double quotation mark ('"' to '"'), and single quotation mark (''' to ''' or '''). This prevents attackers from injecting malicious executable script tags or breaking out of quoted HTML attribute boundaries.

What is the difference between named, decimal, and hexadecimal entities?

Named entities use human-readable mnemonics defined in HTML specifications (e.g., '©' for copyright). Decimal entities represent the character's Unicode code point in base-10 (e.g., '©'). Hexadecimal entities represent the code point in base-16 preceded by 'x' (e.g., '©'). Numeric entities (decimal and hex) have universal XML and HTML support, whereas named entities require specific DTD or HTML5 entity tables.

Why should ' be preferred over ' in HTML4 environments?

While ''' was introduced in XML and standardized in XHTML and HTML5, it was not defined in the HTML 4.01 specification. Older web browsers and legacy parsers may fail to resolve ''', whereas the numeric decimal reference ''' is universally supported across all HTML and XML versions without compatibility issues.

How does Markdown character escaping differ from HTML entity encoding?

Markdown syntax relies on ASCII punctuation characters (such as '*', '_', '`', '#', and '[') to denote structural formatting like emphasis, code blocks, headers, and hyperlinks. Escaping these characters requires prefixing them with a backslash ('\') rather than using ampersand-based HTML entity references, allowing raw text to be rendered literally without triggering markdown parser transformations.

Can HTML entities be safely rendered inside JavaScript or JSON?

No. HTML entity encoding is intended strictly for HTML document body and attribute contexts. In JSON payloads or JavaScript string contexts, HTML entities remain literal strings (e.g. '&' is not decoded by JSON.parse). For JavaScript strings, native Unicode escape sequences (such as '\u0026') or standard backslash quoting should be utilized instead.

Utility #28Client-Side JavaScript

HTML Entity Encoder & Decoder

Encode and decode HTML named, decimal, and hexadecimal entities instantly in your browser. Sanitize special characters to prevent Cross-Site Scripting (XSS) and escape Markdown syntax with zero server logging.

Loading HTML Entity Encoder engine...

HTML Encoding & Escaping Architecture

Understanding HTML Entities, Character Escaping, and XSS Prevention

Web browsers parse raw HTML documents sequentially. When special characters appear inside user-provided content without appropriate entity escaping, browsers interpret them as markup tags or script boundaries, creating severe Cross-Site Scripting (XSS) vulnerabilities.

1. Named vs Numeric Entities

Named entities like © and € are human-readable, but require browser dictionary lookups. Numeric entities (© or ©) map directly to Unicode code points and work reliably across XML and strict legacy parsers.

2. Essential 5 XSS Delimiters

OWASP recommends escaping five fundamental characters before placing untrusted data into HTML bodies or attributes: ampersand (&), less-than (<), greater-than (>), double quote ("), and single quote (').

3. Markdown Syntax Escaping

Markdown processors do not automatically evaluate HTML entities for syntax tokens like asterisks (*), backticks (`), or brackets ([]). Prefixing them with backslashes ensures literal preservation in technical docs and README files.

Core HTML & XML Reserved Characters Reference Table

Character	Named Entity	Decimal	Hexadecimal	Role / Security Purpose
&	&	&	&	Entity delimiter; must always be encoded first to prevent double-escaping.
<	<	<	<	Tag opener; prevents arbitrary HTML element injection.
>	>	>	>	Tag closer; prevents tag termination breakout.
"	"	"	"	Double quote; prevents attribute breakout in double-quoted attributes.
'	'	'	'	Single quote; prevents attribute breakout in single-quoted attributes.

Encoding URLs, tokens, or binary data?

Explore our complementary suite of private developer utilities.

URL Encoder Base64 Converter

Frequently Asked Questions

HTML entities are standardized character sequences used to display reserved characters (like '<' and '>') that would otherwise be parsed as HTML markup tags, as well as invisible characters (like non-breaking spaces) or symbols not readily available on standard keyboard layouts (such as currency symbols or copyright marks).