HTML Entities Explained

When writing HTML, certain characters are reserved by the browser. For example, the less-than sign (<) is used to start a tag. If you want to display an actual < on your web page, you can't just type it—the browser will think you're opening a tag!

Enter HTML Entities

HTML entities are special string replacements that tell the browser to display a reserved character safely.

Common entities include:

• < becomes < (Less Than)
• > becomes > (Greater Than)
• & becomes & (Ampersand)
• " becomes " (Double Quote)

Preventing XSS Attacks

HTML Entity Encoding isn't just for formatting; it is a critical security measure. If you allow users to submit text (like a comment) and display it directly on the page without encoding it, an attacker can submit a <script> tag to execute malicious JavaScript. This is known as Cross-Site Scripting (XSS).

By passing user input through an HTML Entity Encoder, all potentially dangerous tags are neutralized into safe, plain text!