Why HTML Entities Exist

HTML uses certain characters as syntax: < opens a tag, & starts an entity reference, and " delimits attributes. When you need these characters to appear as literal text, you must encode them as entities — &lt; for <, &amp; for &, and &quot; for ". Failing to encode user-generated content is the root cause of XSS (Cross-Site Scripting) vulnerabilities, one of the most common security flaws in web applications.

Named vs. Numeric Entities

Named entities like &copy; (copyright symbol) and &mdash; (em dash) are human-readable but only a fixed set exists in the HTML specification. Numeric entities (&#169; decimal or &#xA9; hexadecimal) can represent any Unicode character, including emoji and characters from non-Latin scripts. In practice, modern UTF-8 encoded pages can include most characters directly without entities — but the five reserved characters (< > & " ') should always be encoded in user content.

Entities and Modern Frameworks

React, Vue, and Angular automatically escape HTML entities in text content by default, preventing XSS. React's dangerouslySetInnerHTML and Vue's v-html directive bypass this protection — use them only with trusted or sanitized content. Server-side template engines like EJS and Jinja2 also auto-escape by default, but raw output modes (<%- in EJS, |safe in Jinja2) skip encoding. Understanding when and why entities are applied helps you work with, rather than against, your framework's security model.