HTML Entities Brackets: Angle, Square, Curly and Backslash

Only one kind of bracket is dangerous in HTML. The others are ordinary characters that people escape out of caution — usually unnecessarily, though there are two contexts where it matters.

Angle brackets are the structural ones

< starts a tag and must always be escaped as &lt; when it appears as text. > is less critical — a stray one is usually rendered literally — but escape it as &gt; anyway for consistency and validator cleanliness.

This is the escaping that prevents cross-site scripting. Everything else in this article is cosmetic by comparison.

The other brackets

Square brackets, curly braces and the backslash have no meaning to the HTML parser and can be written literally. Entities exist if you want them:

[   &lbrack;   or &#91;        ]   &rbrack;  or &#93;
{   &lbrace;   or &#123;       }   &rbrace;  or &#125;
\   &bsol;     or &#92;        |   &vert;    or &#124;

Note &lbrack; and &bsol; are HTML5 additions — the numeric forms work everywhere and are the safer choice in mixed environments.

The two contexts that do matter

Template syntax. Curly braces mean something to Vue, Angular, Handlebars and Blade. To print a literal {{ x }}, use the framework's own escape: @{{ }} in Blade, v-pre in Vue. An entity such as &#123;&#123; does hide the braces from a server-side engine like Blade, which only looks for literal {{. It does not help with Vue mounted on server-rendered HTML: the browser decodes the entity first, and Vue then finds real braces and interpolates them.

Inline JavaScript. A </script> sequence inside a string literal ends the script block regardless of JavaScript quoting. Escape it as <\/script> in the JavaScript, not with an HTML entity — entities are not decoded inside a script element.

Where escaping should happen

Use the platform escaper on output rather than escaping characters by hand. htmlspecialchars and its equivalents cover exactly the characters that matter and get the ordering right.

Escaping brackets that do not need it produces noisier source and, when done inconsistently, hides the places where escaping is genuinely missing.

Frequently asked questions

Do square brackets need escaping in HTML?

No. Only angle brackets are structural.

How do I show literal {{ }} in a template?

Use the framework escape, such as `@{{ }}` in Blade or `v-pre` in Vue. An entity like `&#123;&#123;` only helps when the template engine runs before the browser; a client-side framework sees the decoded braces.

How do I write </script> inside a JavaScript string?

Escape the slash as <\/script>. HTML entities are not decoded inside script elements.