Question 1

What is HTML encoding and when do I need it?

Accepted Answer

HTML encoding converts characters that have special meaning in HTML into their entity equivalents so they display as literal text rather than being interpreted as markup. The five critical characters are: & → &, < → <, > → >, " → ", ' → '. You need HTML encoding whenever you insert user-supplied text into an HTML document, email template, or template string. Failure to encode is the root cause of XSS (Cross-Site Scripting) vulnerabilities.

Question 2

What is the difference between HTML entities and HTML encoding?

Accepted Answer

HTML entities are named or numeric references to characters, e.g. &copy; (©), &mdash; (—), &#8364; (€). HTML encoding specifically refers to replacing characters that would break HTML structure with their entity equivalents. All encoded characters are entities, but most entities are not used for security encoding — they are just a way to write characters that are hard to type or that might be misinterpreted by parsers.

Question 3

Does HTML encoding prevent XSS attacks?

Accepted Answer

HTML encoding prevents XSS only when applied correctly in the right context. Encoding < and > prevents tag injection in HTML content. However, encoding must match the insertion context: inside JavaScript strings, you need JavaScript escaping (\" not "); inside CSS, CSS escaping; in URL attributes, URL encoding. Using HTML encoding in a JavaScript context does not prevent injection. Always use context-aware escaping and a proper templating engine or library.

Question 4

What are numeric character references vs named HTML entities?

Accepted Answer

Named entities use descriptive names: &, <,  . Numeric references use the Unicode code point: &#38; (decimal) or &#x26; (hexadecimal) — both produce &. Numeric references work for any Unicode character, named entities only exist for a defined set. All three forms (named, decimal, hex) produce identical output in browsers. For security-sensitive encoding, named entities for & < > " ' are preferred for readability.

ilmaiset web-kehittäjän työkalut

HTML-tekstikoodain / -dekoodain

Purettu

Koodattu

Miten HTML-koodain/dekoodain toimii

Mitä työkalu tekee

Yleiset kehittäjien käyttötapaukset

Tietomuodot, tyypit tai variantit

Yleiset sudenkuopat ja reunatapaukset

Milloin käyttää tätä työkalua vs. koodia