HTML Guides for control character

What Are Control Characters?

Control characters occupy code points U+0000 through U+001F and U+007F through U+009F in Unicode. They were originally designed for controlling hardware devices (e.g., U+0002 is "Start of Text," U+0007 is "Bell," U+001B is "Escape"). These characters have no visual representation and carry no semantic meaning in a web document.

The HTML specification explicitly forbids character references that resolve to most control characters. Even though the syntax  is a structurally valid character reference, the character it points to is not a permissible content character. The W3C validator raises this error to flag references like �, , , , and others that fall within the control character ranges.

Why This Is a Problem

• Standards compliance: The WHATWG HTML Living Standard defines a specific set of "noncharacter" and "control character" code points that must not be referenced. Using them produces a parse error.
• Unpredictable rendering: Browsers handle illegal control characters inconsistently. Some may silently discard them, others may render a replacement character (�), and others may exhibit unexpected behavior.
• Accessibility: Screen readers and other assistive technologies may choke on or misinterpret control characters, degrading the experience for users who rely on these tools.
• Data integrity: Control characters in your markup often indicate a copy-paste error, a corrupted data source, or a templating bug that inserts raw binary data into HTML output.

How to Fix It

1. Identify the offending reference — look for character references like , , �, , or similar that point to control character code points.
2. Determine intent — figure out what character or content was actually intended. Often, a control character reference is the result of a bug in a data pipeline or template engine.
3. Remove or replace — either delete the reference entirely or replace it with the correct printable character or HTML entity.

Examples

Incorrect: Control character reference

This markup contains , which expands to the control character U+0002 (Start of Text) and triggers the validation error:

<p>Some text &#2; more text</p>

Incorrect: Hexadecimal form of a control character

The same problem occurs with the hexadecimal syntax:

<p>Data: &#x02;</p>

Correct: Remove the control character reference

If the control character was unintentional, simply remove it:

<p>Some text more text</p>

Correct: Use a valid character reference instead

If you intended to display a special character, use the correct printable code point or named entity. For example, to display a bullet (•), copyright sign (©), or ampersand (&):

<p>Item &#8226; Details</p>

<p>Copyright &#169; 2024</p>

<p>Tom &amp; Jerry</p>

Correct: Full document without control characters

<!DOCTYPE html>

<html lang="en">

<head>

<title>Example Page</title>

</head>

<body>

<p>This paragraph uses only valid character references: &amp; &lt; &gt; &#169;</p>

</body>

</html>

Common Control Character Code Points to Avoid

If your content is generated dynamically (from a database, API, or user input), sanitize the data before inserting it into HTML to strip out control characters. Most server-side languages and templating engines provide utilities for this purpose.

A numeric character reference such as  or  resolves to an invisible control character, and HTML doesn't allow those in a document.

Control characters are the non-printing codes U+0001 to U+001F and U+007F, left over from teleprinters and terminals. U+0003 is "End of Text" and U+001B is "Escape", for example. The HTML parser reports an error for any character reference that resolves to one of them, in text or in an attribute value, and the validator names the code point in lowercase hex: (U+0003), (U+001b), (U+007f). Three of them are whitespace and stay valid: 	 (tab), 
 (line feed) and  (form feed). �, 
 and references from 128 to 159 get their own messages.

These references rarely come from hand-written markup. They usually come from text pasted from another application or imported from a database, where an invisible character sat between two words, and a CMS or template then escaped it as  or similar. The character isn't a space, so the words on either side can run together, and some browsers draw a placeholder box where it sits.

Replace each reference with the character that was meant, usually a plain space, or delete it. When the text comes from a database or a feed, clean the stored text or strip control characters before it reaches the template, or every page built from it will repeat the error.

Invalid example

<p>The workshop starts at&#3;9:00 and ends at&#x1b;13:00.</p>

Valid example

<p>The workshop starts at 9:00 and ends at 13:00.</p>