Codectionary / Developer documentation / HTML

Escaping Markup with Character References

Character references represent characters that would otherwise be interpreted as markup or attribute delimiters. Common examples are <, &, and ". Correct escaping depends on the destination context; HTML escaping alone is not a universal defense for JavaScript, CSS, or URL contexts.

Syntax

<button>Save</button>
&
"

Examples

Escaping Markup with Character References: working example

Save as an HTML file and open it in a browser. Expected result: The page shows literal button markup, an ampersand, and an input value containing quotation marks.

<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Working example</title>
</head>
<body>
<p>Write <code>&lt;button&gt;Save&lt;/button&gt;</code> in your HTML.</p>
<p>Research &amp; development</p>
<label>Example <input value="She said &quot;hello&quot;"></label>
</body>
</html>
  1. Expected result: The page shows literal button markup, an ampersand, and an input value containing quotation marks.
  2. &lt; prevents the opening angle bracket from starting a tag.
  3. The double quotes inside the quoted attribute are encoded so they do not end the value early.

Best practices

  • Use textContent for dynamically inserted plain text.
  • Use your template system’s context-aware escaping instead of assembling HTML from untrusted strings.

Browser compatibility

Support applies to the named feature, not every attribute or behaviour in this article. Versions refer to browsers, not operating systems.

The named character-reference rules are documented by the HTML Standard, but there is no single BCD record establishing a first supported version for this lesson.

HTML character-reference parsing

Desktop

Chrome
Unknown
Firefox
Unknown
Safari
Unknown
Edge
Unknown
Opera
Unknown

Mobile

Safari on iOS
Unknown
Chrome for Android
Unknown
Firefox for Android
Unknown
Samsung Internet
Unknown

No single verified compatibility record for this topic. Use the feature-specific articles; no browser support is inferred.

MDN BCD 8.1.5 · Dataset built 2026-10-08 · Mapping reviewed 2026-10-21. These dates are not individual browser-test or claim-verification dates. Unknown means the data does not establish support.

HTML Living Standard

Specifications & further reading