HTML Entity Encoding: Character Representation and Escaping
In HTML, certain characters are reserved by the browser parser as syntax delimiters for elements, attributes, and entities. When displaying source code snippets, documentation examples, or literal punctuation inside HTML content, these reserved characters must be represented as HTML entities (such as < or >). WebTorq HTML Entity Encoder converts reserved and special characters into named or numeric entity equivalents.
Critical Distinction: Entity Encoding vs. Contextual XSS Sanitization
Security Notice: HTML entity encoding is a presentation and syntax-escaping mechanism. It is NOT complete contextual XSS (Cross-Site Scripting) sanitization. While encoding
< and > prevents text from forming new HTML tags in standard text nodes, it does not sanitize dangerous URI schemes (such as javascript: in href attributes), CSS expressions, or inline event handlers. Comprehensive web application security requires contextual sanitizers (like DOMPurify) and Content Security Policies (CSP).Core HTML Reserved Characters
The five foundational XML and HTML characters requiring entity escaping are:
- Ampersand (
&): Encoded as&to prevent ambiguity with entity declarations. - Less-Than (
<): Encoded as<to prevent interpreting text as the start of an HTML opening or closing tag. - Greater-Than (
>): Encoded as>to prevent closing an existing tag structure prematurely. - Double Quote (
"): Encoded as"to prevent breaking out of attribute values delimited by double quotes. - Single Quote (
'): Encoded as'or'for single-quoted HTML attribute contexts.
Named Entities vs. Numeric Character References (NCRs)
The encoder supports standard named character references (such as © for © and ™ for ™) as well as decimal (©) or hexadecimal (©) numeric character references compatible with legacy XML parsers and strict RSS feeds.