Which characters must be escaped in HTML?
In text content, always escape & and <. Inside attribute values, also escape the quote character that wraps the attribute, " or '. Escaping > is not strictly required but is common and harmless. Everything else, including accented letters and emoji, can be written directly when the page uses UTF-8.
Does escaping HTML prevent cross-site scripting?
Escaping is the main defense when user input is placed in HTML text or attributes, but it has to match the context. Text inside a script block, a URL in an href, or a CSS value each need different handling. Templating systems such as React and most server frameworks escape text automatically, so use them rather than building HTML strings by hand.
What is the difference between named and numeric entities?
Named entities such as © are easier to read, while numeric entities such as © or © work for any Unicode character, including ones with no name. Browsers treat them the same way.
Why does my page show < instead of a < sign?
The text was escaped twice. The first pass turned < into <, and the second turned the & in that entity into &, so the source contains &lt; and the browser displays <. Decode once to get back to the right value, and make sure only one step in your pipeline does the escaping.
Do I need entities for accented letters and emoji?
Not on a page served as UTF-8, which almost every modern site is. You can write é, ñ or an emoji directly in the HTML. Entities for these characters are only needed when a system in your pipeline cannot handle UTF-8, such as some older email tools.
