Encode less-than, greater-than, ampersand, and quotes as HTML entities, or decode entities back to characters.
Encoding replaces the ampersand, less-than, greater-than, double quote, and apostrophe so they show as text instead of markup. Decoding reads common named entities and numeric character references.
The encoder touches only the five characters that start markup or quotes. It does not wrap the text in a tag and it does not encode letters.
The decoder knows the common named entities, including amp, lt, gt, quot, apos, nbsp, copy, and mdash, plus decimal and hexadecimal numeric references. An unknown name is left as written.
Choose encode when the text will be placed in HTML.
Choose decode when you already have entities and want the characters.
Encode before you insert the text. Decoding user HTML does not make it safe to inject as markup.
The less-than sign becomes the lt entity, so a tag shows as text instead of markup.
Decoding untrusted HTML and then inserting the result as live markup.
It makes this text safe to show as text. It is not a sanitizer for a document you intend to render as HTML.
Yes. It becomes a non-breaking space.