The same character may require different handling depending on whether it is placed in HTML text, an attribute, a URL, or a script string.
Escape output at the point where it…
Escape output at the point where it enters a specific context. Do not assume an HTML entity string is safe to paste into JavaScript or a database query.
Prefer framework auto-escaping and safe templating helpers…
Prefer framework auto-escaping and safe templating helpers over hand-written replacement tables. Review the final rendered context rather than only the source string.
Treat sanitization and encoding as different actions.…
Treat sanitization and encoding as different actions. Sanitization decides what is allowed; encoding changes how allowed data is represented in a context.
Use the related tool carefully
This guide is paired with a browser-only utility. The tool is a practical aid for small examples and inspection; it is not a substitute for application testing, a formal data pipeline, or professional review where the decision has higher consequences.
Open the related HTML Entity Encoder and Decoder