The Most Dangerous Characters in HTML (and How to Escape Them)
Only seven characters can destroy your HTML document or open security holes. Master these — and you prevent 99% of rendering and injection bugs.
The Dirty Seven
<→<— Ends tags prematurely>→>— Can close tags early&→&— Breaks existing entities"→"— Breaks attributes'→'or'— Dangerous in JavaScript`→`— Template literal killer or
Real Examples That Broke Production
A user named “Tom & Jerry” in a leaderboard → table collapses.
A testimonial with curly quotes “smart” → JavaScript syntax error.
A French résumé with naïve → garbled text on older browsers.
How This Tool Handles Them
Our encoder intelligently chooses named entities when available and universally supported (e.g., "), falling back to numeric for maximum compatibility. It also detects and normalizes non-breaking spaces, zero-width characters, and right-to-left overrides that cause invisible damage.
FAQ
Why not just use textContent everywhere?
textContent strips all HTML. When you need to preserve formatting while staying safe, encoding is the only solution.
Are numeric entities always safer?
Yes. They work in every context: HTML, XML, JSON, and even inside CDATA sections.
Know your enemies. Encode early. Sleep peacefully.