Encode special characters into safe HTML entities (<, >, &) to prevent XSS injection, or decode entities back into readable plain text.
In HTML, certain characters like <, >, and & are reserved as markup syntax delimiters. If you render raw user-submitted text containing these characters directly into an HTML webpage, the browser will interpret them as tags, potentially breaking page layouts or opening severe Cross-Site Scripting (XSS) vulnerabilities.
| Character | Description | Named Entity | Decimal Entity | Hex Entity |
|---|---|---|---|---|
& | Ampersand | & | & | & |
< | Less than | < | < | < |
> | Greater than | > | > | > |
" | Double quotation mark | " | " | " |
' | Single quote / Apostrophe | ' | ' | ' |
© for © or € for €), which are easy for humans to read. Decimal entities use ASCII/Unicode numeric codes (like ©). Both render identically across modern web browsers. & or ’. ClickBasic will immediately unescape them into readable plain text.