W3C HTML5 Character Entity Specifications
An HTML entity is a standardized text string beginning with an ampersand (&) and ending with a semicolon (;) used to display reserved characters (which would otherwise be parsed as HTML markup) and invisible or non-ASCII characters.
The Five Core XML/HTML Reserved Characters
<(Less-than) →<(Prevents browser from opening an HTML tag).>(Greater-than) →>(Prevents tag closing injection).&(Ampersand) →&(Prevents broken entity decoding)."(Double-quote) →"(Prevents breaking HTML attributes).'(Single-quote) →'(Prevents breaking single-quoted attributes).
Cross-Site Scripting (XSS) Mitigation
Rendering raw user-generated content directly inside HTML templates without entity encoding creates severe Reflected and Stored XSS vulnerabilities. Escaping special characters into HTML entities ensures the browser interprets the input as inert text rather than executable script elements.
Synergies with Developer & Security Tools
Combine entity conversion with our webmaster utilities:
- Security Header Hardening: Enforce strict script execution rules with our Security Headers Checker.
- JSON Sanitization: Format and validate data payloads with our JSON Formatter & Validator.
- URL String Encoding: Percent-encode query characters using our URL Encoder / Decoder.
Frequently Asked Questions
What is the difference between Named and Decimal entities?
Named entities (e.g. ©) use human-readable words, while decimal (e.g. ©) and hexadecimal (e.g. ©) entities refer directly to the character's Unicode code point.
Does modern UTF-8 encoding make HTML entities obsolete?
While UTF-8 handles international characters (accents, emojis) natively, the core reserved characters (<, >, &, ") must always be entity-encoded when rendering dynamic data inside HTML.
How does entity encoding impact SEO?
Search engines parse HTML entities correctly when reading page titles and meta descriptions (e.g. & in a title appears as & on Google search results).