Quick answer
HTML character references represent characters using forms such as &, <, or 😀. They are essential when text would otherwise be interpreted as HTML syntax. Context matters: text nodes, attributes, URLs, CSS, and JavaScript require different safety rules.
How to do it
- Determine the output context before encoding.
- Encode at least the characters that have syntactic meaning in that context.
- Decode only trusted or inert text; never treat decoded untrusted markup as safe HTML.
Named and numeric entities
Named references are readable for common characters, while decimal and hexadecimal numeric references can represent a broader range. The browser resolves them to Unicode characters during HTML parsing. Entity encoding is not encryption and does not sanitize every dangerous context.
Avoid double-encoding
If already encoded text is encoded again, & can become & and display incorrectly. Keep raw data internally, escape once at the final output boundary, and use DOM textContent when inserting plain text.
Common mistakes to avoid
- Using HTML escaping for JavaScript or CSS contexts.
- Decoding user input and assigning it to innerHTML.
- Repeatedly encoding content at multiple application layers.
Try the related tool
Use QRFoundry directly in your browser. Tool inputs and uploaded files are processed on your device.
Open HTML Entity Converter