HTML5 Syntax Reference
HTML Entities: Syntax Encoding, Reserved Characters & Security Mechanics
An HTML Entity (character reference) is an escape sequence used to represent characters that either cannot be keyed directly on standard keyboards, would otherwise be misinterpreted as markup syntax, or require precise typographical line-breaking control.
1. Anatomy & Formats of Character References
1. Named Entity Reference
&entity_name;Starts with an ampersand (&) and ends with a semicolon (;). Example: © produces ©. Case-sensitive!
2. Decimal Numeric Reference
&#decimal_number;Begins with &# followed by the base-10 Unicode code point. Example: © produces ©.
3. Hexadecimal Numeric Reference
&#xhex_code;Begins with &#x followed by the base-16 hex code point. Example: © produces ©. Universally compatible with XML.
2. The 5 Essential Reserved HTML Characters
These 5 characters hold syntactical meaning in HTML and must always be escaped in dynamic output to prevent parser corruption and Cross-Site Scripting (XSS):
| Character | Name / Role | Named Entity | Decimal Code | Hexadecimal Code | Syntax Danger |
|---|---|---|---|---|---|
< | Less-than | < | < | < | Starts an HTML tag; unescaped creates rogue DOM elements. |
> | Greater-than | > | > | > | Closes an HTML tag; breaks tag attributes. |
& | Ampersand | & | & | & | Starts an entity reference; unescaped corrupts query strings. |
" | Double Quote | " | " | " | Delimits attributes; premature closing causes attribute injection. |
' | Single Quote | ' | ' | ' | Delimits single-quoted attributes and inline JavaScript strings. |
3. Professional Typographic & Currency Reference Table
| Symbol | Name & Meaning | Named Entity | Unicode Code Point | Typographic Usage |
|---|---|---|---|---|
| Non-Breaking Space | | U+00A0 ( ) | Glues two words together, preventing lonely orphan line breaks. | |
| — | Em-dash | — | U+2014 (—) | Indicates a thematic pause or parenthetical thought in prose. |
| – | En-dash | – | U+2013 (–) | Represents numerical or date ranges (e.g., 2020–2026). |
| … | Horizontal Ellipsis | … | U+2026 (…) | Typographic three-dot omission (better than typing three periods). |
| “ ” | Curly Quotes (Double) | “ / ” | U+201C / U+201D | Professional typographic smart quotes for literature and editorial. |
| € | Euro Currency | € | U+20AC (€) | European Union currency symbol. |
| £ | British Pound | £ | U+00A3 (£) | United Kingdom currency symbol. |
| ¥ | Japanese Yen / Yuan | ¥ | U+00A5 (¥) | Japanese and Chinese monetary symbol. |
| ₹ | Indian Rupee | ₹ | U+20B9 (₹) | Official Indian national currency symbol. |
| © | Copyright Symbol | © | U+00A9 (©) | Legal copyright notice in website footers. |
| ® | Registered Trademark | ® | U+00AE (®) | Federally registered commercial trademark indicator. |
| ™ | Unregistered Trademark | ™ | U+2122 (™) | Unregistered product trademark sign. |
4. Security Deep Dive: XSS Sanitization via Entity Escaping
Cross-Site Scripting (XSS) consistently ranks among the OWASP Top 10 web vulnerabilities. When rendering user comments or search strings into HTML templates:
// Vulnerable Node.js / Express code (DO NOT DO THIS):
res.send(`<h1>Search Results for: ${req.query.q}</h1>`);
// Attacker searches: <script>fetch('/steal?cookie='+document.cookie)</script>
// Browser executes the script immediately!
// Secure Code using Entity Sanitization:
function escapeHtml(str) {
return str
.replace(/&/g, '&')
.replace(/</g, '<')
.replace(/>/g, '>')
.replace(/"/g, '"')
.replace(/'/g, ''');
}
res.send(`<h1>Search Results for: ${escapeHtml(req.query.q)}</h1>`);
// Output sent to browser:
// <script>fetch(...)</script>
// The browser safely displays the raw text without executing it!Frequently Asked Questions (FAQs)
The characters '<', '>', '&', '"', and ''' are syntactically reserved by the HTML tokenizer to identify tag boundaries, entity references, and attribute delimiters. If placed directly in body text or attributes without entity escaping, the browser may misinterpret them as HTML elements or attribute terminators, creating rendering bugs or Cross-Site Scripting (XSS) vulnerabilities.
Named entities use mnemonic names (like © or €), which are human-readable but limited to a subset defined in the HTML specification. Numeric entities directly map to the character's exact Unicode code point in decimal (©) or hexadecimal (©). Numeric hexadecimal references are universally supported across both HTML and strict XML/XHTML parsers without needing external DTD lookup tables.
When user-submitted input (such as comments or search queries) is reflected on a webpage, untrusted input might contain malicious script tags like <script>alert(1)</script>. By converting reserved characters into safe entities (<script>), the browser treats the payload strictly as printable text rather than executable DOM nodes.
In HTML, consecutive regular spaces are collapsed into a single space by default. A non-breaking space ( / U+00A0) prevents two things: (1) It prevents the browser from collapsing whitespace, and (2) It prevents an automatic line break between two adjoining words or values (such as '100 USD' or 'Chapter 4'), preserving typographic hierarchy on mobile screens.
