Q: What is the difference between HTML encoding and HTML entity escaping?
They are often used interchangeably, but technically HTML encoding is a broader term that includes character encoding (like UTF-8), while HTML entity escaping specifically refers to replacing reserved characters (<, >, &, ", ') with their named or numeric entity equivalents to prevent them from being interpreted as HTML markup.
Q: Which characters are escaped?
The tool escapes the five characters that have special meaning in HTML: < (<), > (>), & (&), " ("), and ' ('). These are the characters that could cause rendering issues or security vulnerabilities if left unescaped.
Q: What is the difference between escape and unescape?
Escaping converts special characters to their HTML entity representations (e.g., < becomes <). Unescaping does the reverse, converting entities back to their original characters. Use escape when inserting user content into HTML, and unescape when extracting text from HTML source.
Q: Why is HTML escaping important for security?
Unescaped user input can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are injected into web pages. Properly escaping HTML entities ensures that user-provided content is displayed as text rather than executed as code.
Q: Does this handle numeric HTML entities like <?
The unescape mode handles both named entities (like <) and numeric entities (like < or <). The escape mode converts characters to their named entity equivalents for maximum readability.