HTML Entities Encoder

HTML encoding is necessary when inserting user-generated content into an HTML page. Without encoding, characters like < > & " can be interpreted as HTML code, causing XSS (Cross-Site Scripting) vulnerabilities. It is essential in all templates that display untrusted data.

&amp; is a named entity, while &#38; is a decimal numeric entity (and &#x26; is the hexadecimal one). They all represent the "&" character. Named entities are more readable, numeric ones are universally supported. Both are valid in HTML5.

Normal spaces do not require encoding in HTML. &nbsp; (Non-Breaking Space) is a special space that prevents word wrap and creates an incompressible space. It is used when you want to keep spaces between words that should not be separated on different lines.

HTML encoding of special characters is the first line of defense against XSS, but is not sufficient alone. You also need to: use Content Security Policy (CSP), validate input server-side, sanitize URLs (javascript:// is dangerous), and use frameworks that protect automatically (Laravel Blade with {{ }} escapes automatically).

The named form reads better, while the numeric one, in decimal or hexadecimal, is supported everywhere. They stand for the same character and the browser reads them in exactly the same way.

When it already means something in the markup, such as the angle brackets and the ampersand, and when you want to be sure a rare symbol shows up whatever the page encoding turns out to be.

An ordinary space does not. The non-breaking space entity is what you want when two words must not be split at the end of a line, for instance between a number and its unit of measure.