HTML Escape Tool in Go — Code Examples

HTML escaping converts special characters like <, >, &, and " into their HTML entity equivalents (&lt;, &gt;, &amp;, &quot;) to prevent XSS attacks and ensure correct rendering. Here is how to escape and unescape HTML in each language.

Go's html package provides EscapeString and UnescapeString. Both handle the five critical HTML characters.

package main

import (
    "fmt"
    "html"
)

func main() {
    raw := `<script>alert("xss")</script> & "quotes"`

    // Escape
    escaped := html.EscapeString(raw)
    fmt.Println(escaped)
    // &lt;script&gt;alert(&#34;xss&#34;)&lt;/script&gt; &amp; &#34;quotes&#34;

    // Unescape
    unescaped := html.UnescapeString(escaped)
    fmt.Println(unescaped)
    // <script>alert("xss")</script> & "quotes"
}

• html.EscapeString escapes the five critical characters: <, >, &, ', and ". It uses numeric entities (&#34;) for quotes.
• Go's html/template package auto-escapes content by default — only use template.HTML to mark pre-escaped strings.
• For attribute values, use html.EscapeString; for URL values, use url.QueryEscape or url.PathEscape instead.

Need to html escape/unescape without writing code? The HTML Escape Tool runs entirely in your browser — paste your input and get the result instantly. No signup, no install, no data sent to a server.