Guide

What Are HTML Entities? How to Escape HTML

Some characters have a special meaning in HTML. If you want them to appear on a page as plain text, you have to write them as entities. This is called escaping.

Why some characters are special

Browsers read < and > as the start and end of tags, and & as the start of an entity. Writing <p> in a blog post would create a paragraph instead of showing the text "<p>".

The entities you'll use most

Each entity starts with & and ends with a semicolon:

  • < becomes &lt;
  • > becomes &gt;
  • & becomes &amp;
  • " becomes &quot; (inside attributes)
  • A non-breaking space is &nbsp;

Worked example

The text <p class="demo">Tom & Jerry > Spike</p> escapes to &lt;p class="demo"&gt;Tom &amp; Jerry &gt; Spike&lt;/p&gt;. Pasted into a web page, it now shows the code itself rather than a formatted paragraph.

Escaping and security

Escaping user-supplied text before putting it on a page is a basic defense against cross-site scripting (XSS), where someone sneaks in a <script> tag. Modern frameworks usually escape for you, but it matters when building HTML by hand.

Escaping protects text placed between tags; text placed inside attributes or scripts needs extra care.

Unescaping

Unescaping does the reverse: &amp; turns back into &, and named or numbered entities like &copy; or &#169; become ©. This is handy for reading text copied out of page source or exported data.

Try it yourself

Put this guide into practice with our free HTML Encoder — no sign-up, no download.

Open the HTML Encoder