HTML Entities: When to Escape Special Characters

Use context-appropriate escaping to display text safely in HTML.

HTML uses some characters as syntax. A less-than sign can begin a tag and quotes can delimit an attribute, so untrusted text needs safe handling in the correct context.

Separate text from markup

Escape characters appropriately when inserting untrusted values into HTML text or attributes. Quote attributes and use a well-maintained template rather than manual replacements wherever possible.

Do not confuse encoders

HTML escaping is different from URL encoding and JavaScript string escaping. A value placed in a link or script may require different handling based on its destination context.

Check the rendered result

Inspect ampersands, quotes, accented letters, and symbols on the actual page. Use safe templating and UTF-8 consistently; do not rely on a single generic encoder for every context.

Before relying on the result, test a small example, keep an original copy when a file or value is transformed, and check the output in the application where you plan to use it. Browse the tools directory for a utility that matches your task, and use the other practical guides for related checks.

Editorial note: This guide provides general educational information. Follow the requirements of the software, service, or organization involved when a task has specific rules.