HTML Attribute Token Value Escape
Escape an explicit HTML quoted attribute value for a selected quote character, including ampersand and angle brackets; not a URL, script or style sanitizer.
Description
Escape an explicit HTML quoted attribute value for a selected quote character, including ampersand and angle brackets; not a URL, script or style sanitizer.
A quoted HTML attribute needs escaping for its delimiter and markup-sensitive characters. This converter handles that limited serialization context.
When to use this tool
Escape an explicit HTML quoted attribute value for a selected quote character, including ampersand and angle brackets; not a URL, script or style sanitizer.
- Prepare the supplied value, quote fields for this operation.
- Compare the complete example with the representation used by your own input before carrying the result into another step.
How to use the tool and how it works
- Enter value, quote. Use the exact text syntax, units and index conventions explained below.
- Run the tool. If input validation fails, correct the supplied fields before interpreting any result.
- Read result.escaped. Interpret false, null and empty lists using the distinctions below; they can be valid outputs.
quote must be exactly a single or double quote. Reject NUL, then escape ampersands, angle brackets and the selected quote using character references. Return escaped without surrounding quotes.1
| Input field | Meaning and representation | Accepted input |
|---|---|---|
| value | value. | Text; at most 8,192 UTF-16 code units, subject to the grammar above |
| quote | quote. | Text; at most 8,192 UTF-16 code units, subject to the grammar above |
| Output field | Interpretation |
|---|---|
| result | Object containing the named outputs below. |
| result.escaped | The escaped value under the stated formula or text convention. |
{
"input": {
"value": "a\"\u003c\u0026",
"quote": "\""
},
"output": {
"result": {
"escaped": "a\u0026quot;\u0026lt;\u0026amp;"
}
}
}Limitations and assumptions
- This is not URL validation, script escaping or style sanitization. Existing character references are treated as literal input and their ampersands are escaped again.
- All declared input fields are required and unexpected top-level fields are rejected. Numbers must be finite; lists are limited to 128 entries and ordinary text fields to 8,192 UTF-16 code units, with tighter limits where stated.
- JSON text inputs must parse within bounded nesting and size limits. Numeric outputs outside the safe finite range are rejected; large exact integer results use decimal strings. Indexes and half-open spans are zero-based unless a rank is explicitly described as one-based.
Alternative or Complementary methods
For actual document behavior, inspect a parsed DOM and the relevant HTML algorithm. These tools transform supplied tokens, observations or coordinates; compare the browser result when parsing or layout matters.
References
Similar or alternative tools
- aria state attribute pair checker
ARIA states expose changing interface conditions through defined attribute/value tokens.
- HTML Attribute Occurrence Duplicate Audit
Audit duplicate attribute occurrences under HTML ASCII name lowercase without parsing a tag or losing duplicates; supplied occurrence indexes remain observable.