Q: Which entities can it decode?

All of them: named entities like © and , decimal ones like © and hexadecimal ones like ©. Decoding uses your browser’s own HTML parser, and no HTML is run.

Question 1

Which characters are escaped?

Accepted Answer

The five that have special meaning in HTML: & < > " and '. That is enough to safely put text inside HTML elements and attributes. Turn on "Encode non-ASCII" to also convert characters like é, £ and emoji into numeric entities.

Question 2

Which entities can it decode?

Accepted Answer

All of them: named entities like &copy; and  , decimal ones like &#169; and hexadecimal ones like &#xA9;. Decoding uses your browser’s own HTML parser, and no HTML is run.

Question 3

Does escaping protect against XSS?

Accepted Answer

Escaping these characters is the core defence when inserting text into HTML content and quoted attributes. Other places, such as inside script tags, URLs or CSS, need different handling, so use your framework’s built-in escaping in real applications.

HTML entity encode and decode

How to encode or decode HTML entities

Common uses