# HTML Entity Escaper & Unescaper

- **URL:** https://codeasystem.com/calculators/developer/html-entity-escaper/
- **Category:** developer
- **Description:** Escape the five HTML-critical characters (& < > " ') or unescape named, decimal and hexadecimal entities back to plain text.
- **Primary output:** HTML-escaped: <script>

## Inputs
- Text / markup (name: `text`, type: textarea, example: <p>Tom & Jerry said "hi"</p>)
- Direction (name: `direction`, type: select)

## Outputs
- HTML-escaped: &lt;script&gt;
- Entities emitted: 2
- Escaped characters: & → &amp;, < → &lt;, > → &gt;, " → &quot;, ' → &#39;

## Formula / methodology
```
& → &amp;   < → &lt;   > → &gt;   " → &quot;   ' → &#39;
```

Escaping replaces the ampersand first, then angle brackets, double quotes and apostrophes with their entity forms; the minimal set required to render arbitrary text safely inside element content and attribute values.

Unescaping resolves common named entities plus numeric references in decimal (&#39;) and hexadecimal (&#x27;) notation, leaving anything unrecognized untouched so information is never destroyed.

## Assumptions & limitations
- Only the five essential characters are escaped (no exotic named entities).
- Unescape covers amp, lt, gt, quot, apos and numeric forms.
- Entities outside these sets pass through unchanged.

## How to use
1. **Paste your content**; User comments, code samples, anything destined to appear inside HTML.
2. **Pick escape or unescape**; Escape before inserting into pages; unescape to recover readable text from entity-laden source.
3. **Insert the result safely**; Escaped output can no longer start tags or break attribute quoting.

## Example
The classic XSS probe <script> becomes harmless &lt;script&gt;; displayed literally by browsers instead of executed as markup.

Result for these inputs:

```
HTML-escaped: &lt;script&gt;
```

## About this calculator
### Why escaping prevents XSS

Cross-site scripting happens when attacker-controlled text is interpreted as markup. Escaping < and & strips that power: the browser renders the characters literally instead of building DOM nodes from them. It remains the single most reliable defense layer for user content.

### Entity flavors you will meet

- Named; &amp; &lt; &gt; &quot;
- Decimal numeric; &#38; &#39;
- Hexadecimal numeric; &#x26; &#x27;
- This tool resolves all three when unescaping

## FAQs
### Do I need to escape apostrophes?

Inside element text, no; but yes inside single-quoted attribute values. Tools like PHP’s htmlspecialchars default to escaping it, and we follow that safer convention.

### Why does & get escaped first?

Order matters: escaping it last would double-encode the ampersands introduced by earlier replacements, producing &amp;amp;-style messes.

### Is unescaping dangerous?

The operation itself is pure text substitution. Danger arises only if unescaped output later lands in a page without being escaped again.

### Are emojis affected?

Not at all; they are already valid text characters and pass through both directions untouched.

## Related calculators
- [URL Encoder & Decoder](https://codeasystem.com/calculators/developer/url-encoder-decoder/)
- [JSON Formatter & Validator](https://codeasystem.com/calculators/developer/json-formatter-validator/)
- [Regex Tester](https://codeasystem.com/calculators/developer/regex-tester/)

---
Last updated: 2026-08-23 · Version: 1.0.0 · [HTML version](https://codeasystem.com/calculators/developer/html-entity-escaper/)