Core answer: HTML entities escape characters that are structural or invisible: < → <, > → >, & → &, " → ", ' → '. Named ( ), decimal (©), and hex (©) forms exist — © is © = © = ©. The five structural escapes are mandatory in content; anything beyond UTF-8 text is optional in modern documents. Unescaped user input rendered raw = XSS.

The mandatory five

CharEntityWhy mandatory
<<starts tags
>>ends tags
&&starts entities itself
""breaks attribute values
''breaks single-quoted attributes

Write

if (a < b && c > d)

or the parser eats your comparison as a tag.

The useful named entities

EntityRendersUse
 non-breaking spacekeep "100 km" on one line
©©copyright
® / ™® ™marks
— –— –real dashes
……ellipsis
× ÷× ÷math
±±tolerances
°°degrees
¥ € £¥ € £currency
← →← →arrows

Why escaping is THE security boundary

User comment: . Rendered raw, it executes. Rendered escaped (<script>...), it displays as harmless text. Every framework's auto-escaping (React's JSX, Vue's mustaches) exists for this; dangerouslySetInnerHTML / v-html bypass it — hence the names.

Worked examples

Example 1 — Displaying code. To show

in a tutorial: write <div>. Double-escaping shows the entity itself: &lt; renders "<".

Example 2 — Attribute injection. breaks on the apostrophe; use ' or switch attribute quotes.

Example 3 — The & URL bug. Links with & in query strings (?a=1&b=2) inside HTML attributes should be & — validators complain, and some contexts misparse.

Example 4 — Non-breaking space abuse. Ten   for indentation is 1998; use CSS margin/padding. Legit use: keeping "Figure 3" or "¥ 100" unbreakable.

Common mistakes and myths

  1. Double-encoding — &lt; displays "<" instead of "<"; sanitize once, at the render boundary.
  2. Escaping in the database — store raw text, escape on output; escaping on input corrupts data for non-HTML consumers (emails, APIs).
  3. Assuming entities cover security — entities fix HTML contexts; URLs need percent-encoding, JS strings need JS escaping, CSS needs CSS escaping. Context matters.
  4. Numeric entity confusion — © decimal vs © hex; both fine, don't mix digits across forms by accident.
  5. UTF-8 paranoia — with you can type © directly; entities remain mandatory only for the structural five.

Frequently Asked Questions

Why does HTML need entities?
What are the must-know entities?
Named vs numeric entities — what is the difference?
What is &nbsp; really for?
How do entities relate to XSS?
Cross-site scripting = attacker input rendered as markup: a comment containing