HTML 实体

What HTML entities are for

HTML treats some characters as markup, not as literal text. The ampersand starts character references; angle brackets open tags; quotes delimit attributes. When you need those characters to appear as content—blog posts, documentation snippets, user comments—you encode them as HTML entities (also called character references). The browser’s HTML parser turns the entities back into the intended characters when building the DOM.

An entity may be named (&, <, ") or numeric (&, &). Named forms are easier to read in source; numeric forms can express any Unicode code point even when no well-known name exists. Encoding is a markup-safety and interoperability technique. It is not encryption, and it is not a substitute for context-aware output encoding in application security frameworks.

Encode a sample phrase with from text to HTML entities, then reverse it with from HTML entities to text.

How the two subtools relate

• From text to HTML entities — converts special characters into HTML-safe entity references suitable for embedding in markup.
• From HTML entities to text — expands entity references back to ordinary characters for reading or further processing.

Round-trip when you are preparing examples for a tutorial, cleaning copy-pasted CMS content, or checking that a template escape step matches what you expect. If decode leaves entities untouched, they may be malformed (&amp without ;) or outside the set the decoder recognizes.

Named versus numeric references

Named entities. HTML defines a large set of names ( , ©, €, …). Only a small core is required for basic escaping of text in HTML: &, <, >, and often " / ' depending on attribute context.

Decimal numeric. © is the copyright sign. The number is a Unicode code point.

Hexadecimal numeric. © is the same copyright sign. Hex is common in specs and generated output.

Mixed styles in one document are valid HTML, but teams often standardize on named entities for readability in hand-written content and numeric forms in generated pipelines.

Context matters for security

Escaping rules depend on where the string will land:

• HTML text nodes — escaping <, >, and & prevents accidental tag injection.
• HTML attribute values — quotes must be handled according to the quoting style.
• JavaScript string literals inside HTML — HTML entity escaping alone is insufficient; you need JS-aware encoding.
• URL query components — use percent-encoding, not HTML entities.

Application frameworks provide context-specific encoders for a reason. A general “text → entities” utility is excellent for content authoring and debugging; it is not a complete XSS defense by itself when data crosses into scripts, event handlers, or CSS.

Common legitimate uses

Publishing code samples in HTML. Showing <div> in a page requires encoding the brackets so the browser does not treat them as real tags.

Email and CMS content. Editors sometimes store entities; decoding helps you see the human-readable text for migration or search indexing.

Normalizing copy-paste. Word processors and websites insert   and curly-quote entities; decoding clarifies what was actually pasted.

Localization proofs. Checking that é and é are being handled consistently across templates.

Entities versus URL encoding versus Unicode escapes

Choosing the wrong layer is a frequent bug: putting %20 into HTML text shows literally %20, while putting   into a URL is wrong for servers expecting percent-encoding.

Limitations

• Encoding every character as a numeric entity makes source unreadable and is rarely necessary.
• Decoding does not execute HTML; it only expands references in a string.
• Double-encoding (<) is a common CMS smell—decode carefully and stop when text is readable, or you may overshoot.
• Keep sensitive unpublished content offline when policy requires it.

Summary

HTML entities let markup-significant and special characters travel safely inside HTML source. This hub pairs encode and decode converters for authoring, teaching, and cleanup. Respect output context for security-sensitive applications, prefer clear named entities for hand-written content, and do not confuse HTML escaping with URL or JSON escaping.