HTML character references represent characters that would otherwise be parsed as markup, are difficult to type, or need an unambiguous code point. Escape based on output context; entities are not a universal security filter.
Named references use forms such as &, <, >, ", and . Numeric references use a Unicode code point in decimal, such as ©, or hexadecimal, such as ©. Prefer literal UTF-8 text for ordinary readable characters and references where parsing or whitespace semantics require them.
In text content, encode an untrusted ampersand and less-than sign so data cannot begin markup or a reference. In quoted attribute values, encode the matching quote as well. Greater-than is often safe in text but may be encoded for clarity.
Always quote attribute values. Do not construct raw HTML from untrusted strings; use a template engine or DOM API that applies context-aware encoding.
Normal HTML whitespace collapses. creates a non-breaking space and should be used only where a line break would be semantically wrong, not to indent or align layouts. Use CSS margin, padding, grid, or flexbox for visual spacing.
Other useful typography references include ©, ®, —, and numeric references for symbols without convenient names. Confirm font support and accessible meaning rather than assuming a visible glyph explains itself.
HTML text, HTML attributes, URLs, CSS, and JavaScript are different parsing contexts. HTML entity encoding alone does not safely place data inside a script block, style rule, event handler, or URL scheme. Avoid inline executable contexts and use the encoder designed for the destination.
Do not double-encode. If & becomes & twice, users see & rather than the intended ampersand. Define which layer owns encoding and keep canonical stored data unencoded.
Character references are useful when a character would otherwise begin markup or cannot be typed safely, but output safety depends on the parser context. Escaping text for an HTML text node is different from producing an attribute, URL, CSS value, or JavaScript string. Encode at the final output boundary with an API designed for that context.
Do not pre-encode values before storage. Reusing encoded data in a different context can produce double encoding or leave dangerous syntax active. Keep the original text and apply one contextual transformation when rendering.
Declare UTF-8 early and send a matching Content-Type header. A character reference can represent a Unicode code point, but it cannot repair bytes that were decoded with the wrong character encoding before parsing. Verify the response headers, source bytes, and displayed code point when text appears corrupted.
Numeric references can be decimal or hexadecimal; named references are easier to read for common reserved characters. Prefer the literal Unicode character when it is unambiguous and the document encoding supports it.
Normal HTML whitespace collapses in most text flow. A non-breaking space prevents a line break and should be reserved for content that must remain together, such as a value and unit under a specific editorial rule. Repeated non-breaking spaces are not a layout system; use CSS gap, margin, grid, flexbox, or table structure.
Invisible directional and spacing characters can make debugging difficult. Inspect code points when copied text behaves unexpectedly, and test line wrapping at narrow widths and high zoom so content remains readable.
<p>Use <strong> to mark important text.</p>
<p>Fish & Chips</p>
<button aria-label="Save "Draft"">Save</button>
<p>© 2026 Example Ltd.</p><p>Decimal copyright: ©</p>
<p>Hexadecimal arrow: →</p>No. UTF-8 documents can contain ordinary Unicode text directly. Use references for parser-sensitive characters or a specific semantic reason.
It is supported in HTML5, but ' is also widely used. More importantly, apply the correct attribute or text encoder automatically.
Explore 500+ free tutorials across 20+ languages and frameworks.