Question 1

Does escaping alone prevent XSS?

Accepted Answer

For text content largely yes, but context decides. Placing a value inside an attribute, a <script> block or a URL each needs different escaping. HTML escaping is not a substitute for those.

Question 2

Which characters must be escaped?

Accepted Answer

In text content at minimum < and &. In attribute values also the quote characters. This tool escapes all of them, so you can't get the context wrong.

HTML Entity Converter