Escape text for an HTML context.

C#: HtmlEncode converts markup delimiters in plain text before rendering it as HTML content.

using System;
using System.IO;
using System.Linq;
using System.Text;
using System.Text.Json;
using System.Text.RegularExpressions;
using System.Collections.Generic;
using System.Globalization;
using System.Security.Cryptography;
using System.Threading;
using System.Threading.Tasks;

Console.WriteLine(System.Net.WebUtility.HtmlEncode("<b>Tom & Ada</b>"));

Expected output EXAMPLE

&lt;b&gt;Tom &amp; Ada&lt;/b&gt;

Details

Use Program.cs in a .NET 8 console project and run dotnet run. Uses only the .NET standard libraries. HtmlEncode converts markup delimiters in plain text before rendering it as HTML content.

Keep in mind

HTML escaping is not a substitute for validating URLs or avoiding script and style injection contexts.

✓ Verified

Tested on Ubuntu 24.04.5 LTS · 2026-11-02 18:08:15 UTC · 8.0.425 · libc6 2.39-0ubuntu8.9

Test inputs, results and environment

The exact published code ran in a dedicated Linux test container with prepared inputs. Unprivileged snippet process, external networking disabled, read-only root filesystem, and a fresh temporary working directory. Fixtures and output records are isolated from the application database. Testing covers this example and its stated checks, not every input, operating system, or runtime version. The Linux container shares its host's kernel; this is not a native Windows test.

Architecture / host kernel: x86_64 / 6.18.54.1-microsoft-standard-WSL2
Snippet identity / locale: uid=65534, gid=65534 (unprivileged) / C.UTF-8
Interpreter invocation: dotnet build --no-restore && dotnet out/csharp.dll
Container image ID: sha256:32dc2d998158b6554c99b73b533f423696a0f3e31e8cbea9db10b5eee9a2fadd
Code SHA-256: 8f8124e1a490042542f4b6d27ab98abe295a98ff9755efee740372c529114e30
Dependencies: libc6 2.39-0ubuntu8.9

Test input setup

These are the prepared inputs used by the test harness. See Details above for the prerequisites and how to run this example.

# No input files required.

Observed standard output

&lt;b&gt;Tom &amp; Ada&lt;/b&gt;

Exit code: 0. Standard error: empty. Validation: Exact stdout comparison. System-dependent values above are one recorded run.