When to encode
Only five characters have meaning in HTML text and attributes: & starts an entity, < and > delimit tags, and " and ' end attribute values. Escape those whenever you put untrusted text into a page, and you are safe from markup injection (XSS through HTML context). Everything else, including accented letters, emoji and symbols, can be written literally in a UTF-8 document; encoding them as é is a habit from the Latin-1 era and makes the source harder to read.
Three ways to write a character
| Form | Example | Notes |
|---|---|---|
| Named | é → | 2,125 names in HTML5; readable, but only the five basic ones work in XML without a DTD. |
| Decimal | é | Works everywhere, including XML and SVG. |
| Hex | é | Matches the Unicode code point notation U+00E9; also universal. |
Traps
is a real character (U+00A0). It survives copy-and-paste as an invisible non-breaking space and breaks string comparisons; the Unicode inspector finds it.- Browsers accept some legacy entities without the semicolon (
©,&), so a URL like?a=1©=2in an unescaped attribute becomes?a=1©=2. Always write&in attributes. - Double encoding (
&lt;) shows up as literal<on the page; encode once, at the point of output. - In JavaScript strings, HTML entities are not decoded; use
\u00E9there, or settextContentand skip escaping altogether.
Questions
What is ?
A non-breaking space, U+00A0: a space that prevents a line break and is not collapsed with neighbouring spaces. Use it between a number and its unit (10 km) and nowhere else.
Should I encode accented characters?
Not if the page is served as UTF-8, which every modern page should be. Write é directly. Encode only when the file might be saved in another charset or when you need to make an invisible character visible in source.
Which entities work in XML and SVG?
Only &, <, >, " and ', plus numeric references. Named entities like © cause a parse error in XML unless declared.
How do I show HTML code on a web page?
Encode it: every < becomes <, every & becomes &. Paste the code into the Text box with the first encoding option and copy the HTML output into a <pre><code> block.