HTML encoder

Order is the classic bug. Escape < to < first and then escape ampersands, and you have <, which the page displays as literal text. Encoding here is a single pass over all five characters, so it cannot happen inside the tool, but it happens constantly in pipelines, where a template escapes a value some framework had already escaped. If you are seeing <, find the second escape rather than decoding twice for ever.

The quote is written ' rather than ' on purpose. ' is defined in XML and in HTML5 but was never part of HTML 4.01, so the numeric form is the one every parser understands. Quotes only strictly need escaping inside an attribute value; escaping them in text content is harmless and simpler than deciding each time.

Escaping everything above ASCII as numeric entities is a separate option and mostly historical. It was necessary when pages were served as Latin-1; with UTF-8 it only makes the file larger and harder to read.

Two limits worth stating. Escaping is not sanitising: it makes text display safely, and it does not make user-supplied markup safe to insert, which needs an allowlist-based sanitiser. And the decoder handles numeric entities in full, decimal and hexadecimal, plus the common named ones: a rarer named entity is left exactly as it is rather than guessed at.