Frequently asked questions
What are HTML entities?
HTML entities are codes that represent characters in HTML. They start with & and end with ;, such as < for < or © for ©. They let you show characters that would otherwise be read as HTML code, or that are hard to type.
Which characters must be encoded?
In page text, always encode < and &. Inside attribute values, also encode the quote character used around the value (" or '). Encoding > is optional but common. Everything else, including emoji, can be written directly in a UTF-8 page.
What is the difference between named and numeric entities?
Named entities such as é are easier to read, but only exist for some characters. Numeric entities such as é (decimal) or é (hex) work for every Unicode character.
Does encoding prevent XSS?
Encoding < > & " and ' is the right defense when inserting untrusted text into HTML content or quoted attributes. It is not enough inside <script> blocks, URLs or CSS, which need their own escaping.