HTML实体编码与解码工具

将特殊字符转换为HTML实体（&、<等），或进行反向转换。适用于将文本安全地嵌入HTML。

如何使用本工具

1
Pick a mode with the Encode or Decode toggle at the top.
2
Paste or type your text into the input box.
3
Read the converted result in the output panel below, which updates as you type.
4
Select and copy the output to use in your HTML or document.

HTML实体是用来表示在HTML中具有特殊含义的字符的转义序列：&表示&，<表示<，等等。如果你将用户提供的文本不经编码就直接嵌入HTML，就会造成XSS漏洞。本工具可将文本转换为已编码实体的HTML以便安全嵌入，或将含有实体的HTML解码还原为纯文本。

Pasting a code snippet into a blog post or docs so tags like <div> display literally instead of rendering.
Escaping user-supplied text before dropping it into an HTML template to avoid breaking the markup.
Decoding entity-laden strings copied from page source, RSS feeds, or scraped HTML back into readable text.
Turning a stray &nbsp; or &mdash; from a CMS export back into a normal space or em dash.
Preparing example strings for tutorials where you need to show the raw entity form of a character.
Quickly checking what ' or — decodes to without writing throwaway code.

我应该编码哪些字符？▼

至少要编码：< > & " '。它们在HTML中具有特殊含义，可能破坏解析或造成XSS。

我应该编码所有实体，还是只编码不安全的字符？▼

对于现代的UTF-8页面，只需编码不安全的字符（&、<、>、"、'）。全部编码会使HTML体积膨胀。