HTML Escape / Unescape

Overview

• Converts HTML special characters (<, >, &, ", ') into safe character references such as &lt; that the browser will not interpret as markup (escape), or converts character references back into the original characters (unescape).

• Displaying user input as raw HTML can cause it to be interpreted as unintended tags, leading to XSS (cross-site scripting). Escaping is one of the basic countermeasures against this.

• The six entities &amp; &lt; &gt; &quot; &apos; and &#39; are supported.

Usage

1. 1

   Enter the HTML you want to escape, or the escaped string you want to unescape, into the text area.

2. 2

   Click the "Escape" or "Unescape" button.

3. 3

   The result is displayed below.

Example

<div class="box">Hello & "World"</div>

<div class="box">Hello & "World"</div>

Use Cases

• Escaping user-entered text before displaying it on screen, so it is not interpreted as HTML

• Escaping a piece of HTML source so it can be shown as-is in documentation or a code example without the tags actually rendering

• Unescaping an already-escaped string received from another system or API to check the original text

FAQ

Notes

• Escaping is only one part of XSS defense and does not prevent every kind of attack on its own. Combine it with handling appropriate to the display context.

• The five characters &, <, >, ", and ' are converted. Other characters are left unchanged.

• Unescaping supports the six entities &amp; &lt; &gt; &quot; &apos; and &#39;. Other character references (such as &copy;) are left as-is.