About html encoder / decoder
HTML uses entities to show characters that would otherwise be read as markup. Encoding converts < to <, > to > and & to &.
Why it matters
- Displaying code samples without the browser running them.
- Preventing injected markup (cross-site scripting) when showing user input.
- Typing symbols such as ©, € and ™.
Context matters
HTML encoding is right for text inside elements. Attributes, URLs and JavaScript each need their own escaping rules.
A worked example
The text <script>alert(1)</script> encodes to <script>alert(1)</script>. A browser shows it as text and does not run it. This is the basic defence against cross-site scripting when you display content that users typed.
Which characters
- & becomes & and < becomes <.
- > becomes > and the double quote becomes ".
- The apostrophe is often written as ' or '.
