The EscapeHTML Editorial Team

The EscapeHTML Editorial Team produces the written material for EscapeHTML, an HTML entity encoder and decoder. Nothing is commissioned from outside; articles are drafted and revised internally.

Expect writing about developer tools and little else. Since it escapes text into HTML entities to prevent cross-site scripting and decodes entities back to plain text, with named, decimal and hex styles, most pieces follow the same path through the numbers: escaping user input before rendering it, decoding a scraped string full of entities and checking whether a payload would survive one decode.

Nothing goes live until two things hold: the method is reproducible, and the wording cannot be read as guidance in a regulated field. Where a topic sits close to that line, the article stays with the maths.

Errors and corrections go to support@escapehtml.com. Once a mistake is confirmed it is corrected at source, on the page.

Recent articles

How to Convert Plain Text Strings to HTML Entities Using Client Side Tools
Picture two scenarios. In the first, a user types script alert('hi') /script into your comment box, and your app slaps that string directly into the DOM.
Complete HTML Entity Cheat Sheet for Special Characters and Web Security
If you're rendering user-generated content and only escaping and , you're leaving the door wide open.
Frontend Developer Guide to Escaping HTML Special Characters for Xss Prevention
Before we dive into the deep end of cross-site scripting (XSS) prevention, let’s fix the most immediate vulnerability in your current codebase right now.
When to Use Unicode Encoding Instead of Named HTML Entities
Here's a mistake I see in nearly every web-based developer tool codebase I audit: developers reach for mdash; , hellip; , copy; , and rsquo; like they're some kind of universal safety net.
Safely Unescape HTML Strings Locally: End-to-End Walkthrough
Safely unescape HTML strings locally without server side processing. Follow this friendly, step-by-step developer tools workflow to secure your data today.
HTML Entities: Decode Hex vs Decimal Escapes
Learn the difference between hex and decimal HTML entities for escaping characters. Follow this end-to-end workflow to fix rendering bugs fast. Read now!

Browse all articles →