HTML Entity Encoder/Decoder

// HOW TO USE

1. 01Encode escapes the five HTML-significant characters: <, >, &, ", '.
2. 02Decode understands both named entities (&amp;) and numeric entities (&#38;, &#x26;).
3. 03Use the reference table for the most common entities — handy when reviewing rendered HTML in a test failure screenshot.

// WHEN TO USE

Use this when you need to safely embed user-supplied text in HTML without risking XSS, or when reviewing HTML that uses named or numeric entities and you want to see the actual characters. Encode before inserting any string into raw HTML — it escapes the five dangerous characters (<, >, &, ", ') that browsers treat as markup. Use Decode when a test failure screenshot or server response shows entity strings like &amp;, &#x3C;, or &lt; and you need to read the original text.

// WHAT BUGS THIS FINDS

• XSS via unescaped output

  User-supplied text rendered directly into HTML without encoding allows script injection — Encode shows the escaped form the template should produce; compare it against the actual browser output.

• Double-encoding of ampersands

  An already-encoded &amp; passed through another encoding layer becomes &amp;amp; — Decode reveals the extra layer so you can find where the double-encode is happening.

• Named vs numeric entity mismatches

  Some parsers accept &apos; while others require &#39; — Decode normalises both to the character so you can confirm they represent the same value.

• Smart quote corruption

  Copy-pasted text from word processors contains curly quotes (‘, ’) that some strict parsers require as numeric entities — Encode surfaces the correct &#x2018; form.

// QA USE CASES