Why HTML entities still matter
HTML entities solve two problems: encoding reserved characters that would otherwise be parsed as markup, and handling characters that are hard to type directly. UTF-8 has erased most of the second category — you can paste an em-dash directly into your HTML — but the first remains essential.
Forget to encode & in an attribute and your link breaks. Forget to encode < in user-generated text and you’ve shipped an XSS vulnerability.
The five you must remember
& for &, < for <, > for >, " for ", and ' for '. Everything else is a nice-to-have.
Use cases
- Email templates: HTML in email is even fussier than in browsers. Always encode reserved characters.
- Static site generators: most SSGs encode automatically, but check when authoring inline HTML in markdown.
- CMS escapes: when storing user-generated content, encode on output, never on input.