Does HTML escaping prevent XSS?

In HTML text and quoted attribute contexts, yes. It does not protect script blocks, style blocks, unquoted attributes or URL attributes — a javascript: href survives escaping unchanged.

Should I escape before storing in the database?

No. Store raw data and escape at output. Escaping on input corrupts the data for every other consumer and leads to double-escaped text appearing on the page.

Why does my page display entity codes as visible text?

Double escaping. Something escaped text that was already escaped, so the ampersand introducing the first entity was itself converted into an entity and the browser now renders the code instead of the character. Find the second pass — usually a framework escaping output that application code had already escaped by hand.

Which characters must be escaped?

At minimum & " and '. Escape the ampersand first, or you will double-encode the entities the other replacements introduce.

Developer🔒 Browser (client-side)API available📴 Works offlinebeginner

HTML Escape

Escapes or unescapes HTML special characters so text renders safely.

Data stays in your browser

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Escapes or unescapes HTML special characters so text renders safely.

Why would I use it?

You are injecting user content into HTML and want to prevent broken markup.
You want to display code samples as text, not rendered HTML.
You need to understand why < appears in HTML source.

Real-life example

Input

<b>Bold</b> & "quotes"

Output

&lt;b&gt;Bold&lt;/b&gt; &amp; &quot;quotes&quot;

Escaped text displays literally instead of being parsed.

Input → Process → Output → Next

Input: Paste text with or without HTML.
Process: The browser replaces <, >, &, " and ' with entities.
Output: Escaped or unescaped text.
Next action: Use escaped output when rendering user-generated content as text.

Common mistakes

Escaping text that will be inserted with innerHTML (double-escapes).
Relying on escaping alone for XSS defense — use a safe rendering API too.
Unescaping untrusted input before inserting it.

What the result means

Escaped text is inert HTML; unescaped text renders as markup.

Privacy & security

Your input is processed entirely in your browser and never sent to a YAS server.

API

Endpoint

POST https://yas.sh/api/v1/tools/html-escape

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/html-escape" \
  -H "Content-Type: application/json" \
  -d '{"input":"<b>hi</b>","mode":"encode"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/html-escape", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "<b>hi</b>",
  "mode": "encode"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/html-escape", json={"input":"<b>hi</b>","mode":"encode"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	HTML or plain text
mode	"encode" \| "decode"	No (default "encode")	Direction

Success response

{ "slug": "html-escape", "result": "&lt;b&gt;hi&lt;/b&gt;", "mode": "encode" }

Escape or unescape HTML entities (& < > " ').

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How HTML Escape works

Escaping replaces characters that carry meaning in HTML with entity references: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. The ampersand must be escaped first, otherwise escaping the others would double-encode the ampersands they introduce. Unescaping reverses the mapping and additionally resolves named and numeric character references.

Escaping is context-dependent, which is the part that causes vulnerabilities. HTML-escaping is correct for text content and quoted attribute values, but it is not sufficient inside a script block, inside a style block, in an unquoted attribute, or in a URL attribute such as href — where a javascript: scheme survives escaping untouched. Each context needs its own encoding, and applying the wrong one produces markup that looks escaped and is still exploitable.

When to use it: real-world scenarios

Displaying user input as text

Comments, names and search terms must be escaped before insertion, or a submitted script tag executes for every subsequent viewer.

Showing code samples on a page

Documentation that displays HTML must escape it, otherwise the browser renders the example instead of showing it.

Building HTML email safely

Email templates concatenate strings more often than web templates do, which makes explicit escaping essential.

Decoding escaped content from a feed or database

When a page displays an entity as literal visible text rather than as the character it stands for, an extra encoding pass was applied somewhere in the pipeline. Unescaping once shows you what the value was before that pass.

Pro tips

Escape at output, not at input. Storing escaped data corrupts it for every non-HTML consumer — APIs, exports, search indexes — and leads to double escaping.
Quote every attribute. An unquoted attribute value can be broken out of with a space alone, which HTML escaping does not prevent.
Never inject user data into a script block by HTML-escaping it. JavaScript string context needs JavaScript escaping, and JSON embedding needs its own care.
Use your framework's contextual escaping — React, Vue and modern template engines escape by default. Reach for dangerouslySetInnerHTML only with sanitized input.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

HTML context only. Attribute-URL, JavaScript, CSS and JSON contexts require different encodings.
Escaping is not sanitisation: it renders markup inert rather than filtering dangerous constructs from HTML you intend to keep.
Double escaping produces visible entity text and is the most common misuse.
It offers no protection where the data is used to build a URL, a shell command or an SQL statement.

Frequently asked questions

Does HTML escaping prevent XSS?: In HTML text and quoted attribute contexts, yes. It does not protect script blocks, style blocks, unquoted attributes or URL attributes — a javascript: href survives escaping unchanged.
Should I escape before storing in the database?: No. Store raw data and escape at output. Escaping on input corrupts the data for every other consumer and leads to double-escaped text appearing on the page.
Why does my page display entity codes as visible text?: Double escaping. Something escaped text that was already escaped, so the ampersand introducing the first entity was itself converted into an entity and the browser now renders the code instead of the character. Find the second pass — usually a framework escaping output that application code had already escaped by hand.
Which characters must be escaped?: At minimum & < > " and '. Escape the ampersand first, or you will double-encode the entities the other replacements introduce.

Related tools

HTML → Markdown Markdown → HTML