HTML Entity Encoder: Frequently Asked Questions

< is a named HTML entity for <. < is the decimal numeric entity for the same character (ASCII code 60). < is the hexadecimal numeric entity. All three produce the same character when rendered — named entities are more readable, numeric entities are more universally compatible.

HTML encoding in the correct context prevents the most common HTML injection XSS. However, XSS can occur in other contexts — JavaScript strings, CSS values, URL parameters — where HTML encoding alone is insufficient. Always use a security-reviewed templating engine and apply the appropriate escaping for each context.

  is a non-breaking space — it looks like a regular space but prevents the browser from wrapping the line at that point. Use it to keep words that should stay together on the same line (like '10 kg' or 'Mr. Smith'). Do not use it just to add visual spacing — use CSS padding/margin instead.

Yes — encode the type of quote used to delimit the attribute. In double-quoted attributes (href="..."), encode " as ". In single-quoted attributes (href='...'), encode ' as ' or '. Quotes of the other type do not need encoding inside a given attribute.

This indicates double-encoding — your content was HTML-encoded twice. The first pass turned & into &, the second pass turned & in & into &, producing &amp;. Decode once to restore the correctly single-encoded form.

JSON embedded in a inside JSON would end the script block. Use JSON_HEX_TAG in PHP, or ensure your JSON serialiser escapes forward slashes. Standard HTML entity encoding is not appropriate for JSON content inside script tags.