Skip to main content
🌐 HTML5 / Web Platform Standard: WHATWG HTML Living Standard §13.5 Time: 5 min read Reviewed: September 2024

HTML Entities — Developer Quick Reference

A practical developer guide to named entities, decimal and hexadecimal numeric character references, and modern UTF-8 escaping rules.

TL;DR — Direct Answer

Direct Technical Answer

In modern UTF-8 HTML5 documents (<meta charset="utf-8">), developers should write literal characters directly for all symbols, international text, and emojis. Character references are strictly necessary only for the 5 HTML syntactic delimiters: &amp; (&), &lt; (<), &gt; (>), &quot; ("), and &apos; (').

💡
Production Rule: Do not escape normal non-ASCII text into entities in UTF-8 documents. Use &amp;, &lt;, &gt;, &quot;, and &apos; to prevent HTML parsing breakage and XSS vulnerabilities.

The 5 Essential XML/HTML Entities

These characters carry special syntactic meaning in HTML parsers and must be escaped inside text nodes and attributes.

&amp;

Mandatory when representing an ampersand that does not start an entity reference.

&lt;

Mandatory in text content to prevent the browser from parsing a tag opening.

&gt;

Recommended in text content to avoid ambiguity with closing tag syntax.

&quot;

Mandatory inside double-quoted HTML attribute values.

&apos;

Mandatory inside single-quoted HTML attribute values.

The 5 essential HTML entity escaping rules

HTML html-escaping.html 
<!-- 1. The 5 mandatory HTML syntax delimiter escapes -->
<p>Tom &amp; Jerry</p>          <!-- & becomes &amp; -->
<p>5 &lt; 10</p>                 <!-- < becomes &lt; -->
<p>10 &gt; 5</p>                 <!-- > becomes &gt; -->
<input value="&quot;Hello&quot;">  <!-- " inside attribute becomes &quot; -->
<input value='&apos;World&apos;'>  <!-- ' inside attribute becomes &apos; -->

<!-- 2. Characters in UTF-8 DO NOT need escaping! -->
<p>© 2024 CopyCharacter • All Rights Reserved → Ready 🔥</p>
Program Output 
Tom & Jerry
5 < 10
10 > 5
"Hello"
'World'
© 2024 CopyCharacter • All Rights Reserved → Ready 🔥

Common Mistakes vs Production Patterns

Learn which patterns fail in production and the modern standards-compliant alternatives.

Escaping Non-ASCII Characters in HTML5

Modern web markup with UTF-8 encoding.
AVOID: ❌ Escaping every character into legacy entities 
<p>&copy; 2024 &bull; All Rights Reserved &rarr; &eacute;</p>
Why it fails: Bloats the HTML size, makes source code impossible to read and search, and is unnecessary in UTF-8 documents.
RECOMMENDED: ✅ Direct UTF-8 characters 
<p>© 2024 • All Rights Reserved → é</p>
Why it's better: Clean, readable, searchable, and optimal for compression and SEO.
Source: WHATWG HTML Living Standard §13.5

Edge Cases & Invariants Matrix

A diverse cross-character test matrix comparing character behavior across ASCII, combining marks, emojis, flags, and surrogate fragments.

Test Case Input Glyph Code Units Code Points Graphemes Category Technical Explanation
Ampersand in Query String <a href="/search?q=1&v=2"> — — — Standard Unescaped & in URL attributes can be misinterpreted as an invalid named entity by HTML parsers.

Standards & Source Provenance

All technical invariants, APIs, and behaviors in this guide are verified against official primary specifications.

WHATWG

WHATWG HTML Living Standard

Clause: §13.5 Named Character References

Read Specification →
W3C

W3C HTML5 Specification

Clause: §8.1.4 Character References

Read Specification →