Question 1

What is HTML encoding and when do I need it?

Accepted Answer

HTML encoding converts characters that have special meaning in HTML into their entity equivalents so they display as literal text rather than being interpreted as markup. The five critical characters are: & → &, < → <, > → >, " → ", ' → '. You need HTML encoding whenever you insert user-supplied text into an HTML document, email template, or template string. Failure to encode is the root cause of XSS (Cross-Site Scripting) vulnerabilities.

Question 2

What is the difference between HTML entities and HTML encoding?

Accepted Answer

HTML entities are named or numeric references to characters, e.g. &copy; (©), &mdash; (—), &#8364; (€). HTML encoding specifically refers to replacing characters that would break HTML structure with their entity equivalents. All encoded characters are entities, but most entities are not used for security encoding — they are just a way to write characters that are hard to type or that might be misinterpreted by parsers.

Question 3

Does HTML encoding prevent XSS attacks?

Accepted Answer

HTML encoding prevents XSS only when applied correctly in the right context. Encoding < and > prevents tag injection in HTML content. However, encoding must match the insertion context: inside JavaScript strings, you need JavaScript escaping (\" not "); inside CSS, CSS escaping; in URL attributes, URL encoding. Using HTML encoding in a JavaScript context does not prevent injection. Always use context-aware escaping and a proper templating engine or library.

Question 4

What are numeric character references vs named HTML entities?

Accepted Answer

Named entities use descriptive names: &, <,  . Numeric references use the Unicode code point: &#38; (decimal) or &#x26; (hexadecimal) — both produce &. Numeric references work for any Unicode character, named entities only exist for a defined set. All three forms (named, decimal, hex) produce identical output in browsers. For security-sensitive encoding, named entities for & < > " ' are preferred for readability.

כלים חינמיים למפתחי אתרים

מקודד / מפענח טקסט HTML

מפוענח

מקודד

כיצד מקודד/מפענח HTML עובד

מה הכלי עושה

מקרי שימוש נפוצים למפתחים

פורמטי נתונים, טיפוסים או וריאנטים

מלכודות נפוצות ומקרי קצה

מתי להשתמש בכלי הזה לעומת קוד