HTML اینٹیٹیز اینکوڈر اور ڈی کوڈر

Five characters carry the actual security weight

The ampersand, the two angle brackets and both kinds of quote are what turn ordinary user input into an actual script tag if left unescaped, and encoding them is the oldest defence against exactly that. The [msm_tool slug="html-entities"] handles those five as the essential case; everything past them is a question of display rather than safety.

Modern, UTF-8 pages rarely need the rest

With UTF-8 now close to universal, an accented letter or a curly quote can sit directly in the page source as itself without needing an entity at all. Encoding beyond the five essential characters is mainly for older systems, email templates, or anywhere the page's encoding is genuinely uncertain rather than something every page needs by default.

Named entities read better, numeric ones work everywhere

The named scope covers around forty common characters — the copyright sign, curly quotes, dashes, accented letters — with readable entities, and falls back to numeric references for anything above that. A named entity is easier to recognise sitting in source code; a numeric one works even in the rare case a particular name is not recognised by whatever is reading it.

This is escaping, not sanitising

Encoding makes markup display as literal text rather than being interpreted as code, which is a genuinely different job from removing something dangerous out of HTML that is meant to stay HTML. Escaping output when it should read as plain text is the right tool here; cleaning up markup that must remain markup needs an actual sanitiser instead.

Decoding is safe because nothing ever runs

Decoding is done by handing the text to the browser's own parser through an element that is never attached to the page, so every entity the browser recognises gets resolved without any script content ever having the chance to execute. The element stays detached for the entire operation, which is what makes decoding untrusted input safe to do at all.