Convert special characters (& < > " ') into character entity references, or convert them back. For XSS prevention and avoiding broken layouts
& < > " ' into character entity references. Unescape converts entity references (such as &) and numeric character references (' / ') back into the original characters.
HTML escaping means replacing characters that have a special meaning in HTML (& < > " ') with their corresponding character entity references (& < > " '). This lets the browser display the characters literally instead of treating them as part of a tag or attribute. Unescaping is the reverse: it converts entity references back into the original characters.
If you embed external strings such as user input directly into HTML, characters like < and > can be interpreted as tags, breaking the layout or even allowing malicious scripts to run — a cross-site scripting (XSS) vulnerability. Escaping before output prevents broken layouts and lets you display the entered content safely.
No. The escape and unescape conversion happens entirely in JavaScript inside your browser. The text you enter is never sent to or stored on a server.