HTML Entities
Articles, guides, and in-depth tips for the HTML Entities — everything you need to get the most out of it.
✦ AI-powered — understands natural language
The Invisible HTML Entities: nbsp, shy and Zero-Width Spaces
HTML Encoding Doesn't Stop XSS in JavaScript Context — Why CSP Nonces Are the Missing Second Layer
HTML encoding converts < to < — but it can't protect against XSS in JavaScript contexts, where the browser parses script blocks before HTML encoding applies. Content Security Policy blocks injected scripts at the browser level, using nonces (random per-request values) or hashes to allow only legitimate inline scripts. Here's why both layers are required, how CSP nonces work, and what violation reports reveal about attacker probing.
In UTF-8, Most HTML Entities Are Unnecessary — But These Five Still Are
HTML entities were invented to survive character encoding translation before UTF-8 was universal. In today's UTF-8 world, é and é are identical — but five entities (&, <, >, ", ') remain essential because they escape characters that have structural meaning in HTML, not encoding meaning. Here's which entities are legacy, which remain necessary, and why is a special case that's about rendering behavior rather than encoding.
Double Encoding: Why "&amp;" Shows Up, and Why the "Quick Fix" Can Be Dangerous
"&amp;" appearing on a webpage instead of "&" is one of the most common HTML-entity bugs — an ampersand encoded twice, because encoding got applied at multiple uncoordinated points in a pipeline. Here's why this happens, why "encode once, at output, as late as possible" is the fix, and why "fixing" double-encoding by removing encoding from the wrong stage can quietly turn a cosmetic bug into an XSS vulnerability.
Unicode Fundamentals: ASCII History, UTF-8 Encoding, Byte Order Marks, and Why Mojibake Happens
ASCII was designed in 1963 for 7-bit telegraph machines. Every country's attempt to extend it to 8 bits was incompatible, producing mojibake when files crossed systems. Here's how Unicode solved the problem, why UTF-8 became dominant (backward compatibility with ASCII), what byte order marks are, and what character encoding corruption actually looks like.
XSS and HTML Encoding: The Five Contexts That Require Different Escaping
XSS is still the most common web vulnerability — and unescaped HTML is the mechanism. Here's how cross-site scripting actually works, the five encoding contexts that require different treatment, why React is safe by default but PHP isn't, and how CSP adds a second layer.
HTML Entities — Encode & Decode Special Characters for Correct, Safe HTML
Learn what HTML entities are, why they exist, the most common named entities, how numeric entities work for any Unicode character, and when modern UTF-8 pages don't need them — with a free HTML entities tool.
HTML Entities — Encode & Decode Special Characters Correctly
Learn what HTML entities are, which characters always need encoding, how to use <, &, , and special symbols correctly — with a free HTML entities encoder/decoder tool.
