- Which characters does HTML escaping convert?
- The five standard HTML entities: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes '.
- Does escaping HTML prevent XSS attacks?
- HTML escaping is one important layer, but not a complete solution on its own. It's effective when inserting user-supplied text into HTML content. However, different contexts require different escaping — inserting values into JavaScript, URLs, or CSS attributes each need their own approach. For robust XSS prevention, use a content security policy (CSP) and a trusted sanitization library alongside HTML escaping.
- When should I escape HTML?
- Always escape user-supplied content before inserting it into an HTML document to prevent cross-site scripting (XSS) attacks.
- Can I unescape HTML entities back to plain text?
- Yes — paste your escaped HTML and switch to Unescape mode to convert all entities back to their original characters.
