HTML Escape Tool in C# / .NET — Code Examples
HTML escaping converts special characters like <, >, &, and " into their HTML entity equivalents (<, >, &, ") to prevent XSS attacks and ensure correct rendering. Here is how to escape and unescape HTML in each language.
C# provides WebUtility.HtmlEncode in System.Net (all .NET targets) and HttpUtility.HtmlEncode in System.Web (ASP.NET only).
using System;
using System.Net;
string raw = "<script>alert(\"xss\")</script> & \"quotes\"";
// Escape (System.Net.WebUtility — available in all .NET targets)
string escaped = WebUtility.HtmlEncode(raw);
Console.WriteLine(escaped);
// <script>alert("xss")</script> & "quotes"
// Unescape
string unescaped = WebUtility.HtmlDecode(escaped);
Console.WriteLine(unescaped);
// <script>alert("xss")</script> & "quotes"
// ASP.NET Core — use HtmlEncoder from Microsoft.Extensions.WebEncoders
// using System.Text.Encodings.Web;
// string encoded = HtmlEncoder.Default.Encode(raw);
// In Razor views, @variable is automatically HTML-encoded.
// Use @Html.Raw(variable) only for trusted, pre-escaped content.- WebUtility.HtmlEncode is the preferred choice for non-ASP.NET code — it requires no extra packages.
- In ASP.NET Core Razor, all @ expressions are auto-encoded; only @Html.Raw bypasses encoding.
- HtmlEncoder.Default from Microsoft.Extensions.WebEncoders is more configurable and suitable for ASP.NET Core middleware.
Need to html escape/unescape without writing code? The HTML Escape Tool runs entirely in your browser — paste your input and get the result instantly. No signup, no install, no data sent to a server.
Open HTML Escape/Unescape →HTML Escape Tool in JavaScript / Node.js
In browsers, create a temporary DOM element to escape HTML reliably. In Node.js, use a library like he or escape manually.
HTML Escape Tool in Python
Python's standard library includes the html module with html.escape and html.unescape. No third-party packages needed.
HTML Escape Tool in Go
Go's html package provides EscapeString and UnescapeString. Both handle the five critical HTML characters.
HTML Escape Tool in Java
Java's standard library lacks an HTML escaping utility. Use Apache Commons Text (StringEscapeUtils) or Spring's HtmlUtils.
HTML Escape Tool in PHP
PHP provides htmlspecialchars for escaping the five critical characters and htmlentities for full entity encoding. Always pass ENT_QUOTES.
HTML Escape Tool in Ruby
Ruby's CGI module provides CGI.escapeHTML and CGI.unescapeHTML. Rails adds the h helper and auto-escapes ERB output by default.
HTML Escape Tool in Rust
The html-escape crate provides encode_text and decode_html_entities. For template rendering, askama and minijinja auto-escape by default.