Escape HTML-significant characters or decode entities back to plain text.
Convert HTML-significant characters such as ampersands, angle brackets, and quotes into entities, or decode named, decimal, and hexadecimal entities back to plain text. The output remains text and is never injected as markup. Entity encoding is useful when displaying text inside an HTML context, but it is not a universal XSS sanitizer: safe escaping depends on the output context and the rest of your application.
<div class="test">Tom & Jerry</div><div class="test">Tom & Jerry</div>Encode changes the small set of markup-significant characters into named or numeric entities. Decode accepts named and numeric forms through a detached browser element, but the decoded value stays plain text and is never inserted as HTML.
The encoder converts ampersand, less-than, greater-than, double quote, and apostrophe to common safe entities.
No. Decoded output is kept as plain text and is not inserted into the page as markup.
No. Escaping must match the output context and be combined with appropriate application security controls.
No. HTML entities are for HTML text or attribute contexts; URL percent encoding is for URL components.