Html Entity Encoder Calculator

An HTML character reference replaces a character with a sequence that begins with an ampersand and ends with a semicolon. Three forms exist: named references such as the ones for ampersand and copyright, decimal numeric references written as a hash plus the Unicode code point, and hexadecimal numeric references written as a hash, an x, and the code point in base 16. Named references are limited to a fixed list defined by the specification, whereas numeric references can address any Unicode code point by value. Only a small set of characters strictly requires escaping, and which ones depends on context. In ordinary text content, the ampersand and the less-than sign must be escaped, since they begin a character reference and a tag respectively. Inside a double-quoted attribute value the double quote must also be escaped, and inside a single-quoted value the apostrophe must. The greater-than sign is escaped by convention rather than necessity. Escaping these five characters is the baseline defense against cross-site scripting, because it prevents user-supplied text from being parsed as markup. Two caveats matter in production. Encodings are not interchangeable across contexts: HTML escaping does nothing for a value interpolated into a JavaScript string, a URL parameter, or a CSS declaration, each of which needs its own rule. And double encoding is a frequent bug in which already-escaped text is escaped again, so readers see a literal amp sequence on the page. It usually stems from storing escaped text in the database and escaping again at render time.

Character references are inherited from SGML, standardized as ISO 8879 in 1986, the metalanguage on which HTML was originally defined. SGML needed a way to write markup delimiters as literal text and to express characters absent from the limited character sets of the day, so it provided both named entity sets and numeric references. HTML 2.0, published as RFC 1866 in November 1995 with Tim Berners-Lee and Dan Connolly as authors, incorporated the ISO Latin-1 entity set, supplying roughly 250 named references covering accented letters and common symbols. HTML 4.0, a W3C Recommendation in December 1997, added two further sets covering mathematical, Greek, and typographic characters including the em dash and the ellipsis. XML 1.0, released in 1998, took the opposite approach and predefined only five entities for ampersand, less-than, greater-than, quote, and apostrophe, requiring numeric references for everything else, which is why XHTML documents could not safely use the non-breaking-space name without declaring it. The WHATWG HTML standard, developed from 2004 onward and now maintained as a living specification, enumerates more than 2,200 named references and defines exact parser behavior for malformed ones, including references written without a trailing semicolon. As UTF-8 became the near-universal document encoding, entities stopped being necessary for representing non-ASCII text, and their role narrowed to what it remains today: escaping markup-significant characters, chiefly for security.