Escape a string so it can be safely embedded in HTML, in a JavaScript literal, or in a URL — and reverse the process when you need the original text back.
HTML entity escaping for safe display of user content
JavaScript string escaping including quotes and newlines
URL escaping for query values and path segments
Frequently asked questions
Why does escaping matter for security?
Unescaped user input is how cross-site scripting happens. Escaping ensures text is displayed as text rather than executed as markup or code.
Which mode should I use?
Match the destination: HTML escaping for page content, JavaScript escaping for code literals, URL escaping for anything going into a link.