Convert special characters to HTML entities, or decode entities back to text.
HTML entities are the escaped representations of characters that have special meaning in HTML — < and > for angle brackets, & for ampersand, " for quotes — needed whenever you want to display those literal characters in HTML rather than have them interpreted as markup.
This encodes plain text into HTML-safe entities (turning a literal "<" into "<" so it displays as a less-than sign instead of starting a tag), or decodes entities back into their literal characters. This is different from URL encoding, which handles a different set of characters for a different context (URLs, not HTML markup) — use the URL Encoder for query strings and URLs instead.
This is particularly useful when displaying user-submitted content or code snippets on a webpage, where failing to encode special characters can break the page layout or, in more serious cases, open a cross-site scripting vulnerability.
Worked example: the text <script>alert(1)</script> encodes to <script>alert(1)</script> — each angle bracket becomes its entity, so a browser displays the literal text of a script tag on the page instead of actually running it as JavaScript. This is exactly the mechanism that prevents a classic cross-site scripting attack: if user-submitted text containing a script tag is encoded before being inserted into a page, the tag shows up as visible text rather than executing.
HTML entities escape characters that have special meaning in HTML markup (like < and &). URL encoding escapes characters that have special meaning in a URL. They serve different purposes and use different escape formats — use whichever matches where the text is actually going.
Displaying unescaped user input directly in HTML can allow injected script tags to execute (cross-site scripting) rather than display as plain text — encoding is a basic defense, though a full security review needs more than just this.
The core HTML-significant characters: < > & " ’ — the ones that would otherwise be interpreted as markup or attribute syntax rather than literal text.