Encoding replaces characters that have meaning in markup with their entity equivalents, so they display as text instead of being read as code. The five that always matter are the ampersand, the two angle brackets and both kinds of quote — those are what turn user input into a script tag, and escaping them is the oldest defence against it. Beyond those five, you choose how far to go.
The named scope uses readable entities for around forty common characters — the copyright sign, curly quotes, dashes, accented letters — and falls back to numeric references for everything else above ASCII. Decoding runs the text through the browser's own parser using a detached element, which resolves every entity the browser knows without executing anything, since the element is never attached to the page.
How much to encode, and when
-
The five special characters are the security ones:
everything else is a display or transport question. If you are escaping user input to put in a page, those five are what matter.
-
Modern pages rarely need the rest:
with UTF-8, which is now near-universal, an accented letter or a curly quote can sit in the source as itself. Full encoding is for older systems, email templates and anywhere the encoding is uncertain.
-
Named entities are readable, numeric ones are universal:
the named form is easier to recognise in source; the numeric form works even where a name is not recognised.
-
This is escaping, not sanitising:
encoding makes markup display as text. It does not remove anything dangerous from HTML you intend to keep as HTML — that is a different job needing a real sanitiser.
Five characters carry the actual security weight
The ampersand, the two angle brackets and both kinds of quote are what turn ordinary user input into an actual script tag if left unescaped, and encoding them is the oldest defence against exactly that. The [msm_tool slug="html-entities"] handles those five as the essential case; everything past them is a question of display rather than safety.
Modern, UTF-8 pages rarely need the rest
With UTF-8 now close to universal, an accented letter or a curly quote can sit directly in the page source as itself without needing an entity at all. Encoding beyond the five essential characters is mainly for older systems, email templates, or anywhere the page's encoding is genuinely uncertain rather than something every page needs by default.
Named entities read better, numeric ones work everywhere
The named scope covers around forty common characters — the copyright sign, curly quotes, dashes, accented letters — with readable entities, and falls back to numeric references for anything above that. A named entity is easier to recognise sitting in source code; a numeric one works even in the rare case a particular name is not recognised by whatever is reading it.
This is escaping, not sanitising
Encoding makes markup display as literal text rather than being interpreted as code, which is a genuinely different job from removing something dangerous out of HTML that is meant to stay HTML. Escaping output when it should read as plain text is the right tool here; cleaning up markup that must remain markup needs an actual sanitiser instead.
Decoding is safe because nothing ever runs
Decoding is done by handing the text to the browser's own parser through an element that is never attached to the page, so every entity the browser recognises gets resolved without any script content ever having the chance to execute. The element stays detached for the entire operation, which is what makes decoding untrusted input safe to do at all.