What characters should be escaped with their HTML entities. For example, & is escaped with &.

Should ' be escaped with '?

8 Answers 8


I don't have comment privileges, or I would have left this as a comment on an earlier answer.

DO NOT, I repeat, DO NOT escape an apostrophe in HTML using


This is not a valid HTML character entity reference. It is an XML character entity reference. While Firefox and Chrome, at least, will render the above as an apostrophe in an HTML document, Internet Explorer will not. And it is following the standard when it refuses to do so.

You may escape an apostrophe in HTML using


But I don't believe it is, in general, necessary.



  • 6
    I recognise this will have been correct when this was posted, however looking at the Wikipedia article it appears &apos is now valid of HTML5. That being said if you have to support legacy browsers or writing HTML emails for Outlook then you're best sticking to ' if you deem it necessary to escape the character.
    – tomhughes
    Commented Oct 16, 2019 at 14:36

I don't agree with Nate. You should ideally use as little escaping as possible and use UTF-8 to express characters natively. To do this you need an editor that can handle UTF-8 as well as a correct charset declaration, such as:

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />

However, you should make it a habit to escape the characters that have a special meaning in (X)HTML, namely:

< &lt;
> &gt;
" &quot;
& &amp;
' &#39;

This will make sure you're not accidentally writing markup when you want to write these characters. This is especially important for user input, to maintain security. It's less obvious, but it's actually important to escape ". If a string ever ends up in a HTML attribute (title="something" etc.) the user could end the attribute and insert their own markup. Imagine what happens if the user enters " onclick="alert('hello'); and you insert that to title="..."

If you're using PHP, you can use the htmlspecialchars function to do this. Other languages may have other similar functions.

Update: I stand corrected on the apos issue. Damned pesky IE.

  • I've got two contradicting answers now. One recommends escaping ' and the other does not. What should I believe?
    – Tom
    Commented Apr 18, 2011 at 12:05
  • 9
    In short. You may or may not escape it at your discretion. If you do, use &#39; not &apos;. If, for whatever reason, you use single quotes for a HTML attribute like title='something' you must obviously escape any single quotes inside that the attribute value.
    – nitro2k01
    Commented Apr 18, 2011 at 21:32
  • your second paragraph is what is important to me, my OCD kicked into overdrive when I saw red botches of text in my git commit due to unescaped apostrophes imgur.com/a/LN0Pu89
    – eballeste
    Commented Mar 2, 2019 at 23:48

It depends on your use case, but we should probably be discouraged from using ' in natural language generally, so the issue shouldn’t arise unless you have computer code in your XML.

Where we have strings translated, we find that some translators replace the closing quotes with the unicode curly quotes, but leave the straight quotes as the opening quotes, leaving them visually unbalanced and looking unprofessional.

The unicode characters and should replace ' where possible, much as and should replace ". This is useful because computers don’t recognise curly punctuation as special. (Although I'm amused to see that Stack Overflow/Chrome considers ‘don’t’ to be a spelling error, whereas it's happy with ‘don't’.)

It doesn't help that we have the very enticing ' and " characters right on the keyboard.

  • 1
    This answer seems to be implying that I should stop using the apostrophe key for contractions in written speech. That doesn't seem right to me. Commented May 24, 2020 at 18:53
  • @MaximillianLaumeister You can press any key you like: it's just saying that instead of worrying about escaping ASCII ' or " in those contexts where it matters (because no *ML parser should choke on those in explicit or implicit CDATA sections) either you or preferably your software, should sidestep the whole issue by replacing them with curly quotes which look much better. But not if the text in question is computer code, because that's very annoying. Commented May 27, 2020 at 8:57

So let's see if StackExchange itself encodes an apostrophe using an HTML entity.

Here are some examples from the source code of this page.

(1) Question title: Encoded.

Should I escape the Apostrophe ( &#39; ) character with its HTML entity (&amp;#39;)?

(2) drew's answer: Not encoded.

But I don't believe it is, in general, necessary.

(3) Tom's comment on nitro2k01's answer: Encoded.

I&#39;ve got two contradicting answers now. One recommends escaping &#39; and the other does not. What should I believe?

So it goes both ways.

However, this page's source code never uses &apos;. All the encodings are of the form &#39;. This is consistent with nitro2k01 and drew's advice not to use &apos;.

  • 1
    Although in all 3 instances it doesn't need to be HTML encoded.
    – MrWhite
    Commented Nov 10, 2015 at 23:05
  • If you look at the meta description here, you can see some characters have been escaped while others have not e.g. <meta name="twitter:description" property="og:description" itemprop="description" content="What characters should be escaped with their HTML entities. For example, &amp;amp; is escaped with &amp;amp;amp;. Should ' be escaped with &amp;amp;#39;?"> As ' is inside "", it rightly does not have to be escaped.
    – Daniel
    Commented Feb 27 at 22:04

Where is that string going?

Your answer depends on the context:

  1. If you are writing a paragraph in HTML with this data, it might be enough to escape <, > and &:


  2. If you are writing into an HTML attribute, though, like

    <a href='/some/path/{string}'>...</a>

Then you should absolutely escape the apostrophe. This can be an attack vector if an attacker put this in for string:

string = "' onmouseover='alert(\"nasty script here!\")' data-ignore='"
  1. Same thing goes for double quotes. I've even read that the backtick ` is vulnerable, since that could be used for HTML attributes too. If you don't have an automatic HTML syntax checking script as part of your deploy routines, assume that any of these three could be used, and must be escaped for HTML attributes.

  2. At the extreme, even unquoted attributes are valid, so the space character also would need escaping. And !, @, $, %, (, ), =, +, {, }, [, and ], all of which can break out of an attribute and allow inserting a new one.

What I do

To do escaping in JavaScript, I use JQuery's $(element).text(string) or $(element).attr(attrname, string) to do the escaping for me. Be very careful with $(element).html(unsafe), which does not escape your HTML!

On server-side code, I have to carefully evaluate the risk for each case and read the documentation carefully. This will depend on the particular language and libraries you are using, like Rails, Django, raw PHP, Drupal, etc.


If you are considering stopping the problem as early as possible, before it even gets into your database, hold your horses. HTML-escaping the text stored in your DB can take you on a hellish ride. What if you later want to allow certain HTML tags, but not others, like italics, bold, colors and tables? What if you missed something in your first pass, but your escaper already escaped & as &amp; and " as &quot;? Will it turn those into &amp;amp; and &amp;quot;?

My approach is to only perform SQL escaping for the database, but leave all HTML special chars in for later processing. This way, I can debug and fine-tune my HTML escapes easily. Mind, that also means I can't trust my own SQL tables if they have user-provided strings.


Never trust user-controlled input, and always quote your HTML attributes!

Based on: There's more to HTML escaping than &, <, >, and " by Ryan Grove


If your apostrophe part of display content, no need to escape it.

  • 1
    "If your apostrophe belongs to content, escape it." - This would seem to be incorrect (as if missing the word "don't"). If the apostrophe is part of content then don't escape it - there shouldn't be any need to.
    – MrWhite
    Commented Nov 10, 2015 at 22:51

' is not escaped in the meta description tag on this page.


<meta name="twitter:description" property="og:description" itemprop="description" content="What characters should be escaped with their HTML entities. For example, &amp;amp; is escaped with &amp;amp;amp; Should ' be escaped with &amp;amp;#39;?">

That is correct as it can also result in unwanted side effects.


<meta name="description" content="Here&amp;#39;s a tough challenge for #creativeleaders: leading multidisciplinary teams. How do you lead the team to success?

#learninganddevelopment #designleadership…">

That said perhaps also & should not be escaped here as well?

This is also output verbatim on slack etc.


The easiest way to do the job without using the actual entity is to use PHP's htmlentities() or htmlspecialchars() functions:

$val = htmlspecialchars("Don't", ENT_QUOTES, 'UTF-8');
  $val = htmlspecialchars(trim($_POST['val']), ENT_QUOTES, 'UTF-8');
echo "<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'> 
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en' class='njs'> 
    <meta http-equiv='Content-type' content='text/html;charset=utf-8' />
    <title>Special Characters</title>
    <style type='text/css'>
      @import 'special.css';
  <form method='post' action='' id='fm' name='fm'>
    <input type='text' value='$val' name='val' id='val' />
    <input type='submit' value='submit' name='sub' id='sub' />
  <script type='text/javascript' src='special.js'></script>
  • 6
    Is this a joke?
    – Su'
    Commented Oct 17, 2012 at 2:07
  • @Su' I'm afraid it isn't...
    – William
    Commented Sep 11, 2014 at 12:39
  • Similar to htmlspecialchars() you can use htmlenties() with php.net/manual/en/function.htmlentities.php you have different flags. e.g. ENT_COMPAT Will convert double-quotes and leave single-quotes alone.
    – Daniel
    Commented Feb 27 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.