In HTML, the characters <, >, and & carry special meaning and must be escaped — but a surprising amount of entity traffic on English-language sites has nothing to do with security at all. It's about dashes, curly quotes, and the mess that word processors leave behind.
Named vs numeric entities
An HTML entity can be written two ways: as a named code (<, &, ") or a numeric one (<, &, or in hex, <). Browsers render both identically — named entities are usually easier to read, while numeric ones can represent any Unicode character, even ones without a dedicated name.
The Word paste problem: smart quotes and dashes
Copy a paragraph from Microsoft Word or Google Docs into a CMS text field, and it often carries "curly" typographic characters that look nothing like what was typed: “/” for curly double quotes, ’ for a typographic apostrophe, and —/– for em and en dashes instead of a plain hyphen. These render fine as entities but can break naive string comparisons or search-and-replace scripts that only expect a straight " or -.
The minimum set of characters to escape
<→<— so a tag doesn't start.>→>— to correctly close text after a tag.&→&— so the ampersand isn't read as the start of another entity."and'→",'— required inside quoted attribute values.
A relic of the pre-Unicode era
Named entities like ©, ™, and é date back to a time when a web page's declared charset might not support anything outside ASCII. Now that UTF-8 is the near-universal default, you can usually type © or é directly into a file — entities survive mostly as a compatibility fallback and as the safe way to output the reserved markup characters themselves.
The connection to XSS
Most XSS vulnerabilities happen precisely because user-supplied text gets inserted into HTML without escaping. Output "<script>...</script>" without converting it to entities, and the browser will execute it as code. Escaping is a basic — though not the only — defense when rendering dynamic content.
Context matters: text vs. attribute
Escaping <, >, and & is enough for text between tags, but inside a quoted attribute you also need to escape the specific quote character being used — double or single. If an attribute is delimited by double quotes and its value contains an unescaped double quote, the markup breaks earlier than expected, and part of the value leaks into the HTML as a separate attribute.