flashman
← All posts

HTML entity textarea round-trip debugging

Debug HTML entity encoding that leaves quotes unchanged: the textarea escapes ampersands and brackets, a no-break space becomes nbsp, and Lt is not lt.

2026-10-22 · 6 min read · Rahul Chitturi

  • html
  • entities
  • debugging

The HTML entities page encodes by putting the text into a textarea and reading innerHTML. It decodes by assigning the box to that textarea's innerHTML and reading the value. An empty string returns an empty string before either step. A space is not empty, so it is kept. Nothing trims the box.

The sample <div>flashman & friends</div> encodes to &lt;div&gt;flashman &amp; friends&lt;/div&gt;. Quotes are not part of that escaping.

Escape three characters, and a no-break space

& becomes &amp;. < becomes &lt;. > becomes &gt;. A double quote stays a double quote. An apostrophe stays an apostrophe. é and 🙂 stay themselves. A newline stays a newline, not a numeric character reference. A tab stays a tab. A no-break space becomes &nbsp;.

Text that is already encoded is encoded again. a&amp;b becomes a&amp;amp;b. Decode is the opposite direction, and it runs once. &amp;amp; becomes &amp;, not &. Run decode a second time if you wanted the ampersand.

  • Expect quotes to survive encode.
  • Expect > to become &gt;.
  • Expect a no-break space to become &nbsp;.
  • Decode once, then look again.

Decode names the browser actually knows

&amp; is &. &AMP; is also &. &lt; is <. &Lt; is not. That name is U+226A, the character ≪. &gt; and even &gt without a semicolon are >. &lt;div&gt without a semicolon on the last name is still <div>. &unknown; is left as the characters &unknown;.

Numeric forms work. &#39; and &apos; and &quot; are the quotes encode refused to create. &#10; is a newline. &#13; is also a newline, because a textarea value does not keep a carriage return. &#x0; and a code point past Unicode become the replacement character. &#128512; is 😀. &#x1F642; is 🙂.

Leave tags as text

The decoder is a textarea, so a tag in the box is not an element. <b>bold</b> comes back as that text. </textarea><b>x</b> comes back as that text too. &lt;script&gt;alert(1)&lt;/script&gt; decodes to the characters of a script tag. It does not run.

Use the HTML entities tool for this pass, the Markdown editor when you need the sanitized HTML of a document, the XML tool when the brackets are markup rather than text, and diff when an encode and a later decode are not the original string. The usual miss is a second encode, a no-break space, or the name Lt.

Try these tools