HTML entity encode & decode.

Escape text to HTML entities so it renders as literal characters instead of markup — or decode entities (named or numeric) back to text. Two-way and live; the encode side is the core defense against XSS.

Render it as text, not as code

The whole point of HTML escaping is to keep data from turning into markup. A stray <script> in a comment, a quote that closes an attribute early — these are how cross-site scripting happens, and the fix is to escape the handful of HTML-significant characters before the text reaches the page. Most frameworks do this for you, but the moment you build HTML by hand, you own it. Encode on the way out, decode when you need the original back.