DevToolsForYou

HTML Escape Tool in Python — Code Examples

HTML Escape Tool in PythonUse the online tool →

HTML escaping converts special characters like <, >, &, and " into their HTML entity equivalents (&lt;, &gt;, &amp;, &quot;) to prevent XSS attacks and ensure correct rendering. Here is how to escape and unescape HTML in each language.

Python's standard library includes the html module with html.escape and html.unescape. No third-party packages needed.

Also in:JavaScript / Node.jsGoJavaPHPRubyRustC# / .NET
Python 3
import html

raw = '<script>alert("xss")</script> & "quotes"'

# Escape (quote=True is the default — also escapes " and ')
escaped = html.escape(raw)
print(escaped)
# &lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt; &amp; &quot;quotes&quot;

# Escape but leave quotes untouched (for use inside HTML tag text, not attributes)
escaped_no_quotes = html.escape(raw, quote=False)
print(escaped_no_quotes)
# &lt;script&gt;alert("xss")&lt;/script&gt; &amp; "quotes"

# Unescape HTML entities back to raw characters
unescaped = html.unescape("&lt;b&gt;Hello&lt;/b&gt; &amp; &quot;world&quot;")
print(unescaped)  # <b>Hello</b> & "world"
Notes & gotchas
  • html.escape with quote=True (default) also escapes double quotes — use this when inserting into HTML attributes.
  • html.unescape handles named (&amp;), decimal (&#38;), and hex (&#x26;) entities.
  • In Jinja2 / Django templates, use the |e filter or enable autoescape — don't manually call html.escape in templates.
Try it in your browser

Need to html escape/unescape without writing code? The HTML Escape Tool runs entirely in your browser — paste your input and get the result instantly. No signup, no install, no data sent to a server.

Open HTML Escape/Unescape →
HTML Escape Tool in other languages

HTML Escape Tool in JavaScript / Node.js

In browsers, create a temporary DOM element to escape HTML reliably. In Node.js, use a library like he or escape manually.

HTML Escape Tool in Go

Go's html package provides EscapeString and UnescapeString. Both handle the five critical HTML characters.

HTML Escape Tool in Java

Java's standard library lacks an HTML escaping utility. Use Apache Commons Text (StringEscapeUtils) or Spring's HtmlUtils.

HTML Escape Tool in PHP

PHP provides htmlspecialchars for escaping the five critical characters and htmlentities for full entity encoding. Always pass ENT_QUOTES.

HTML Escape Tool in Ruby

Ruby's CGI module provides CGI.escapeHTML and CGI.unescapeHTML. Rails adds the h helper and auto-escapes ERB output by default.

HTML Escape Tool in Rust

The html-escape crate provides encode_text and decode_html_entities. For template rendering, askama and minijinja auto-escape by default.

HTML Escape Tool in C# / .NET

C# provides WebUtility.HtmlEncode in System.Net (all .NET targets) and HttpUtility.HtmlEncode in System.Web (ASP.NET only).