What Are HTML Entities and Why Are They Used?

The two original reasons

Escaping structure. Some characters mean something to the HTML parser, so writing them literally changes the document. < starts a tag, & starts an entity — to display them as text you must escape them.

Representing unavailable characters. In the days of ASCII-only editors and ambiguous encodings, © was the reliable way to write ©. With UTF-8 everywhere, this reason has largely disappeared.

The five that matter

These are the ones that break markup or enable cross-site scripting if left raw:

&   &amp;      <   &lt;      >   &gt;
"   &quot;     '   &#39;   (&apos; is HTML5 only)

Escape order matters when doing it by hand: replace & first, or you re-escape the ampersands you just inserted and produce <.

Named versus numeric

Named entities are readable — →,  , © — but only exist for characters that were given a name. There are over 2,000 in HTML5, and you will use about thirty.

Numeric references work for every character: decimal → or hexadecimal →, both giving →. When no name exists, this is the only option.

When to skip them entirely

With <meta charset="utf-8"> declared, you can type →, ©, é and emoji directly in the source. That is more readable than an entity and renders identically.

So the practical rule: always escape the five structural characters, use entities for invisible characters such as   where the intent would otherwise be invisible in the source, and type everything else literally.

And escape on output rather than storing escaped text — a database full of & breaks every non-HTML consumer of that data.