Less than sign (<) in HTML
The less than sign opens a tag, so any literal < in text content must be written as <. Of all the HTML escapes this is the one that is never optional.
At a glance
- Character
- <
- Named entity
- <
- Decimal reference
- <
- Hex reference
- <
- Unicode code point
- U+003C
- Unicode name
- LESS-THAN SIGN
- In the entity reference
- Math, and pinned in quick access
In detail
What the parser does with a less than sign depends entirely on the next character. Followed by a letter it begins a start tag, followed by a slash an end tag, followed by an exclamation mark a markup declaration such as a comment or a doctype. Only when the next character is something else, a space or a digit, does the parser fall back to treating it as ordinary text.
That fallback is why <p>x < 5</p> renders as expected while <p>x <5</p> quietly swallows everything up to the next greater than sign. The first is invalid markup that a browser forgives; the second is invalid markup that eats your content. Neither is something to rely on, and neither survives a strict XML or XHTML parser.
This character is also the whole basis of cross site scripting. Any place where text from a user reaches the page without the less than sign being converted, an attacker can open a tag. Escaping < is not a formatting nicety, it is the boundary between data and code, which is why every template language escapes it by default and why turning that default off needs a reason.
Inside a script block the rules invert. Character references are not expanded there, so < would appear literally in your JavaScript. The sequence that matters instead is a closing script tag: a string containing that sequence ends the block early. The usual fix is to break it up, for example by writing the slash escaped as <\/script>.
Examples
<p>Use <code>Array<string></code> for a list of strings.</p><script>
// The literal sequence would end the block here.
const marker = "<\/script>";
</script>Things that catch people out
- Escaping only on output but storing raw user input is fine; escaping on input and again on output is not, and gives you &lt; on the page.
- A sanitizer that strips tags is not the same as an escaper that encodes them. Stripping changes what the user wrote, encoding preserves it exactly and renders it safely.
- Autolinkers and markdown converters often run after your escaping step and can reintroduce a raw less than sign. Check the order of the pipeline, not just the last stage.
Try it: HTML Entity Reference
Search 152 entities across 9 categories, switch the copy format between the character, the name, the decimal form and the hex form, and copy in one click.
HTML Entity Reference
LOCAL · Browser-OnlySearchable reference of 150+ HTML entities with one-click copy in any format
152 entities across 9 categories
Commonly Used
→Arrows(13)
±Math(35)
$Currency(8)
…Punctuation(21)
©Symbols(24)
πGreek(30)
½Fractions(6)
●Geometric(7)
æLatin Special(8)
Click any entity card to copy it in your chosen format. All data is embedded in the page and works offline.
Related HTML entities
All html entities →Greater than sign (>) in HTML
A lone > is legal in HTML text but not everywhere. The contexts that force >, the comment and CDATA rules, and why escapers emit it anyway.
Ampersand (&) in HTML
The ampersand opens every character reference, so a bare & in markup is ambiguous. What & fixes, and the query string trap that quietly eats a parameter.
Double quotation mark (") in HTML
The straight double quote ends an attribute value, so it needs " there. Where that matters, where it does not, and how JSON in a data attribute breaks.
Apostrophe (') in HTML
' is defined in HTML5 and XML but was absent from HTML 4.01. Why ' is the safer numeric form and when a single quote actually needs escaping.
Em dash (—) in HTML
The em dash at U+2014, its named, decimal and hex references, how it differs from the en dash and hyphen, and the practical reasons to prefer a comma.
En dash (–) in HTML
The en dash at U+2013 joins ranges and paired terms. Its entity forms, how wide it really is, and how to stop spreadsheets turning your ranges into dates.
Tools for this
- HTML Entity Reference Free online HTML entity reference - search and copy HTML entities with live preview
- HTML Entity Encoder Free online HTML entity encoder - encode or decode HTML entities to prevent XSS and display issues