What are HTML entities?
HTML entities are text representations of characters that have special meaning in HTML or cannot be typed directly. The ampersand (&), less-than sign (<), greater-than sign (>), and double quote (") are the four critical characters that must be escaped in HTML content, because they are part of HTML syntax itself. If you insert a literal < into an HTML document without escaping it, the browser interprets it as the start of a tag.
HTML entities take the form &name; (named entities like &, <, >) or &#number; (numeric entities like < for <). There are hundreds of named entities for symbols, accented characters, and special typography, but the four security-critical ones are the ones to always escape in user-generated content.
The XSS prevention use case
Cross-site scripting (XSS) attacks work by injecting malicious HTML or JavaScript into a page through user input. If a user submits the string as a comment on a website, and the server renders it without escaping, the browser executes the script. Escaping converts < to < and > to >, making the string render as visible text rather than executable HTML. Every modern web framework has built-in HTML escaping — understanding what it does (and when it might not be applied) is essential for web security.
The four essential escapes
& (ampersand) → & — must always be the first escape applied, because the others introduce ampersands themselves. < (less-than) → <. > (greater-than) → >. " (double quote) → " — required inside double-quoted HTML attributes. ' (single quote) → ' or ' — required inside single-quoted HTML attributes. These five characters cover all basic HTML injection scenarios.
When to encode and when to decode
Encode when inserting untrusted content into HTML — user-provided text, database values, API responses. Decode when reading HTML content to extract plain text — stripping HTML entity encoding from content that was stored in a database with entities already applied, or when comparing encoded and unencoded versions of the same string. Decode with caution: decoded content is no longer safe to insert into HTML without re-encoding.
Email template use case
HTML email templates must carefully encode special characters. An ampersand in a URL inside an email (&utm_source=email) must be encoded as &utm_source=email in the HTML attribute. An apostrophe in a subject line or preview text should be encoded as ' or '. Many email rendering bugs trace back to unencoded special characters that email clients interpret differently.