HTML Escape / Unescape
Escape the five characters that break markup, or decode an entity-laden string back to plain text.
—
Worked example
Escaping <p> produces <p>. The browser renders that as the literal characters instead of starting a paragraph.
HTML uses angle brackets as syntax, so any text containing them has to be escaped before it is placed into a page. The five characters that matter are &, <, >, " and '. Escaping exactly those five is sufficient in text and in quoted attribute values.
Escape, then insert
The order matters: escape when the text enters HTML, not before. Escaping twice produces a page showing < to the reader, which is a common bug when a template engine already escapes and the developer escapes again.
Unescaping is for display and debugging
Decoding entities is useful when you are inspecting stored content or reading a feed that double-encoded. It is not a sanitiser — unescaping untrusted input and then inserting it into HTML reintroduces exactly the injection that escaping prevented.
Not the same as URL encoding
HTML entities and percent-encoding solve different problems in different layers. A URL parameter inside an HTML attribute needs both: percent-encode the value, then HTML-escape the whole attribute.