HTML entity encode/decode · Guide
HTML Entities Brackets: Angle, Square, Curly and Backslash
Only one kind of bracket is dangerous in HTML. The others are ordinary characters that people escape out of caution — usually unnecessarily, though there are two contexts where it matters.
Angle brackets are the structural ones
< starts a tag and must always be escaped as < when it appears as text. > is less critical — a stray one is usually rendered literally — but escape it as > anyway for consistency and validator cleanliness.
This is the escaping that prevents cross-site scripting. Everything else in this article is cosmetic by comparison.
The other brackets
Square brackets, curly braces and the backslash have no meaning to the HTML parser and can be written literally. Entities exist if you want them:
[ [ or [ ] ] or ]
{ { or { } } or }
\ \ or \ | | or |Note [ and \ are HTML5 additions — the numeric forms work everywhere and are the safer choice in mixed environments.
The two contexts that do matter
Template syntax. Curly braces mean something to Vue, Angular, Handlebars and Blade. Writing {{ x }} as literal text requires the framework escape — @{{ }} in Blade, v-pre in Vue — not an HTML entity, since the framework processes the template before HTML parsing.
Inline JavaScript. A </script> sequence inside a string literal ends the script block regardless of JavaScript quoting. Escape it as <\/script> in the JavaScript, not with an HTML entity — entities are not decoded inside a script element.
Where escaping should happen
Use the platform escaper on output rather than escaping characters by hand. htmlspecialchars and its equivalents cover exactly the characters that matter and get the ordering right.
Escaping brackets that do not need it produces noisier source and, when done inconsistently, hides the places where escaping is genuinely missing.
Frequently asked questions
Do square brackets need escaping in HTML?
No. Only angle brackets are structural.
How do I show literal {{ }} in a template?
Use the framework escape, such as @{{ }} in Blade or v-pre in Vue. HTML entities will not work.
How do I write </script> inside a JavaScript string?
Escape the slash as <\/script>. HTML entities are not decoded inside script elements.
Ready to try it?
Open the free browser-based HTML entity encode/decode and apply what you just read — no sign-up, runs locally.
Open the HTML entity encode/decode tool