Text to HTML Converter
<p>First paragraph with a < sign and an & ampersand.</p> <p>Second paragraph.<br /> A line break inside it.</p>
The text to HTML converter escapes the three characters that must never appear raw in markup and then, optionally, adds structure. Three modes are available: wrap blocks in paragraph tags, turn every newline into a break, or escape only and add nothing.
How it works
- Escaping always happens first, and always to the same three characters: & becomes &, < becomes <, > becomes >.
- Paragraph mode splits on blank lines, wraps each block in <p> and converts single newlines inside a block to <br />.
- Break mode converts every newline to <br /> without adding paragraphs, which suits content going into an existing container.
- Escape-only mode adds no tags, for pasting text into HTML that already has its own structure.
The ampersand is escaped first. Escaping it after the angle brackets would double-escape the entities just created, turning < into &lt; and displaying the entity code rather than the character.
Examples
Paragraph mode
Text
First paragraph with a < sign. Second paragraph. A line break inside it.
Result
<p>First paragraph with a < sign.</p> <p>Second paragraph.<br /> A line break inside it.</p>
The blank line separates two paragraphs; the single newline inside the second becomes a break rather than a new paragraph.
Escape only
Text
if (a < b && c > d)
Result
if (a < b && c > d)
No tags added. This is what you need when pasting code or user-supplied text into a page without it being parsed as markup.
Frequently asked questions
Why does the ampersand have to be escaped first?
Because escaping it afterwards would double-escape everything already produced. Convert < to < and then escape ampersands, and you get &lt;, which displays as the literal text "<" rather than a less-than sign. Order is the whole trick.
Are quotes escaped too?
Not in this tool, because it produces text content rather than attribute values. Inside an attribute, quotes must be escaped as well, but text destined for an attribute needs different handling throughout, so mixing the two would be misleading.
Which mode should I use?
Paragraph mode for prose going into a page. Break mode when the text is already inside a container that handles its own spacing. Escape-only when you are inserting into existing markup and want no structure added at all.
Is this enough to make user input safe?
For text content, escaping these three characters is the correct defence. It is not sufficient inside attributes, URLs or script blocks, each of which needs its own escaping rules. Never treat one escaping function as universal.