What Are HTML Entities? Escaping < > & and Special Characters

Have you ever seen a run of symbols that starts with an ampersand and ends with a semicolon, like "<" or "&," while writing HTML? Those are HTML entities (character references). At first they look like an annoying substitution, but they are an essential mechanism that lets HTML interpret symbols correctly and display characters exactly as intended. This article explains, step by step, what HTML entities are, why they are needed, and what kinds exist.

What Are HTML Entities

An HTML entity (also called a character reference) is a way to safely write symbols that carry special meaning in HTML syntax, as well as characters that are hard to type directly. They share a common shape: they begin with "&" (an ampersand) and end with ";" (a semicolon). For example, the less-than sign "<" is written as "&lt;," and the ampersand itself is written as "&amp;."

The main reason HTML entities are needed is that some symbols are used by HTML tags and syntax themselves. For instance, "<" signals the start of a tag, so if you write it directly in your text, the browser mistakes it for the beginning of a tag. To display "<" as a literal character, you must replace it with a character reference.

To see what string a symbol converts into, it is easiest to type it into the HTML Entity Converter and check. Comparing the input and output lets you feel which character maps to which entity.

Why Escaping Is Needed

In HTML, several symbols are treated as "markup instructions" rather than "content." The representative characters are as follows.

• < (less-than): signals the start of a tag, so left as-is it is read as part of a tag.
• > (greater-than): signals the end of a tag.
• & (ampersand): the opening symbol of a character reference itself.
• " (double quote) and ' (single quote): used to enclose attribute values.

For example, if you want the screen to show "2 < 3 is true" and you write "2 < 3" directly in HTML, the browser reads everything from "< 3" onward as an unfinished tag, so the display breaks or part of it disappears. By writing "2 &lt; 3" instead, the browser correctly renders it as the literal symbol "<."

In this way, character references are a mechanism for distinguishing "symbols that should be interpreted as markup" from "symbols you want to display as text." This is especially important when posting program code or commands inside an article; neglecting to escape causes broken layouts and missing content. When you want to embed text into HTML safely, converting it all at once with the HTML Entity Converter is the reliable approach.

Named vs Numeric Character References

HTML entities come in two broad styles: named character references and numeric character references. Both can represent the same character, but the notation differs.

Named character references use human-readable names like "lt," "gt," and "amp." They are easy to remember and highly readable, but only names predefined in the HTML specification can be used. There are several hundred representative ones, covering nearly all commonly used symbols.

Numeric character references directly specify the number assigned to a character (its Unicode code point). You write "&#60;" in decimal or "&#x3C;" in hexadecimal. Their strength is that any symbol without a name, or special characters such as emoji, can be written as long as you know the number. For example, the copyright sign becomes the same "©" whether you use the named "&copy;" or the numeric "&#169;."

If you are unsure which to use, remember: named for common symbols, numeric for characters that have no name. That is enough in practice.

A List of Common Entities

Here is a summary of the HTML entities that appear most often in practice. Master this basic set first and you can handle almost any situation.

The most important of these are the first three (< / > / &). Because these three relate directly to HTML syntax, they must always be escaped when they appear as literal characters in text. Unlike a normal space, &nbsp; does not break automatically, so it is handy when you want to keep a number and its unit together, like "10 kg." Doing these conversions by hand is tedious, so using the HTML Entity Converter lets you process them accurately and quickly.

Handling Quotes Inside Attribute Values

Character references become especially important inside a tag's attribute values. Attribute values are usually enclosed in double quotes (") or single quotes ('), and a problem arises when you want to include the same kind of quote inside the value.

For example, suppose you want to put the string He said "hello" into a title attribute. If you keep the double-quote enclosure and also write a double quote inside the value, the browser reads the first inner quote as the end of the attribute, and everything after it breaks. By replacing the inner double quotes with &quot;, you can correctly distinguish the attribute enclosure from the value content.

title="He said &quot;hello&quot;"

Similarly, when you want to include an apostrophe inside an attribute value enclosed in single quotes, use &#39; (or &apos;). Inside attribute values, reliably escaping both "&" and the quote used for the enclosure is the basis for preventing broken output. When you dynamically assemble form default values or link text, a missed escape here easily leads to unexpected bugs, so take care.

The Link to Mojibake and XSS

HTML entities relate not only to appearance but also deeply to mojibake (garbled text) and security.

1. The link to mojibake

With numeric character references, you can reliably display any character defined in Unicode regardless of the page's character encoding. Even in old environments or where the encoding setting is uncertain, a character specified by number tends to render as intended, making it one way to guard against mojibake. That said, modern web practice is best served by standardizing on UTF-8, and entities are best regarded as a supplementary measure. Note that repairing already-garbled text is a separate problem from character references and requires a dedicated tool.

2. The link to XSS (cross-site scripting)

If you embed a string entered by a user directly into HTML, a malicious person can slip in tags such as "<script>" and run unauthorized scripts, an attack known as XSS. The basic defense is to escape symbols such as < > & " ' into character references before embedding. Once escaped, an entered "<script>" is no longer an executable tag but simply displayed on screen as the literal text "<script>."

In this way, character references are a foundation for both display accuracy and security. Conversely, there are times when you want to turn an entity-encoded string back into the original symbols, and you can decode it with the HTML Entity Converter. Also, when you want to reorganize HTML text, headings and lists and all, into Markdown, the HTML to Markdown Converter quickly turns HTML containing entities into a readable format. It is useful when you want to keep an article or spec in a plain form.

Start by swapping characters in the HTML to Markdown Converter or the HTML Entity Converter and see for yourself how each symbol changes. Touching the mechanism with your own hands is the shortcut to understanding.

Please note that this article is intended to provide general information. The best answer for HTML specifications and security measures varies by environment and requirements. Make your decision after checking the latest official specifications and documentation, and professional sources where needed.