When submitting HTML that contains entities to the OWASP HTMLSanitzer, entities are converted.

For example:

BEFORE: <p>blah blah blah &diams;</p>

The resulting HTML ends up looking like this:

AFTER: <p>blah blah blah ?</p>

The entity is converted back to it's original unicode character.

Why does OWASP do that? Are entities unsafe? For me, having the entities solves any issues down the road with unicode text.

Additionally, is there a way to allow the entities to remain untouched in HTMLSanitzer?

  • 1
    No, they’re not unsafe, but they’re generally unnecessary. If you need entities to remain untouched, what you generally really need is to fix your encoding.
    – Ry-
    Jun 24, 2014 at 15:31
  • I don't see any methods in OWASP that take the encoding character set. Do you?
    – sproketboy
    Jun 24, 2014 at 15:50
  • 1
    No, it sounds like you’re not returning UTF-8. Do you have a <meta charset="utf-8"> tag? Are you encoding your output as UTF-8?
    – Ry-
    Jun 24, 2014 at 16:24
  • 2
  • 1
    Just because somebody reports it as a bug doesn’t mean that it’s a bug. Once again, please make sure that you are sending a response with consistent encoding. (<meta charset="utf-8" /> should do the trick.) ♦ is what you would get if you responded with UTF-8 and the browser (due to lack of a specified encoding, which you always need – this is actually a security issue) assumed it was ISO-8859-1.
    – Ry-
    Jun 24, 2014 at 16:31

1 Answer 1


They are safe, but is very good practice escape or convert them

This will allow you avoid being:

  • script injected
  • Face a browser text incompatibility ( have you seen those sites with unicode like chars? )

And Probably more

See it as a standard way to represent a text as it should be in different languages and codifications, like some strict utf8 will show a bad formatted text if you don't escape them, because some special chars with acute or tilde, etc will be not recognizable to the end user when showed up.

  • 1
    It's a bug. Valid HTML should include the entities over having to use any particular encoding. The sanitizer should not alter entities or the Policy should have an option around it.
    – sproketboy
    Jun 24, 2014 at 16:30
  • @sproketboy: You don’t have to use any particular encoding. UTF-8 is just the best one.
    – Ry-
    Jun 24, 2014 at 16:46
  • 1
    agree with @minitech, UTF-8 is the best for me, but sadly you don't store everywhere as utf8 Jun 24, 2014 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .