Encode User Content for Web Display
Prevent XSS attacks by encoding user-generated content before rendering it in HTML pages.
Common HTML entities reference
Web tips
Never render user-provided text directly in HTML without encoding. A user could inject <script> tags causing XSS attacks.
Encoding < as < and > as > turns any HTML tags in user input into plain visible text, not executable markup.
Most server-side frameworks (Django, Rails, Laravel) auto-encode template variables. This tool is for manual encoding or debugging.
Paste suspicious user input here to inspect what HTML entities it contains before adding it to your codebase or database.
Conas a Oibríonn sé
Cén fáth ár gceann a úsáid?
Also check out…
Encode Content for RSS Feeds
Encode HTML content for RSS feed item descriptions
Sanitise User Input for HTML Output
Encode user-provided strings before inserting them
Encode Special Characters for HTML Email
Encode characters like &, <, >, and © as HTML enti
Encode Content for XML
Encode special characters for XML files, RSS feeds