Common HTML entities

&&Ampersand

<<Less than

>>Greater than

""Double quote

''Apostrophe

 ␠Non-breaking space

When should entities be used?

Encode text when it must appear literally inside HTML source, especially &, <, and >. Quote encoding is also important when text is inserted into a quoted attribute. Entity encoding is contextual output escaping—not a universal replacement for sanitization.

Text content

Usually encode ampersands and angle brackets so user text cannot be interpreted as markup.

HTML attributes

Encode the matching quote character as well as ampersands and angle brackets.

Unicode characters

Modern UTF-8 HTML can contain Unicode directly. Numeric entities are useful when an ASCII-only representation is required.

Security boundary

Use a trusted context-aware escaping library in production. URL, CSS, JavaScript, and HTML contexts have different rules.

Frequently asked questions

Why must ampersands be encoded first?

An ampersand begins an entity reference. Encoding it prevents existing text from being accidentally interpreted as an entity.

Are emoji supported?

Yes. Numeric modes iterate Unicode code points, so an emoji becomes one hexadecimal or decimal entity instead of two broken surrogate entities.

Is entity encoding the same as HTML sanitization?

No. Encoding can safely represent text in a specific context. Sanitization parses and filters markup according to an allowed policy.

Should every non-ASCII character be encoded?

Usually not when a document is correctly served as UTF-8. Use full numeric encoding only for compatibility or an ASCII-only transport requirement.