HTML character encoding is fundamentally about the intersection of two systems: the HTML markup language, which uses specific characters as syntactic delimiters, and Unicode, the universal character encoding standard that assigns a unique code point to every character in every writing system. When these systems overlap, as they do with characters like < (less-than sign, used for HTML tags), > (greater-than sign, closing HTML tags), & (ampersand, starting entity references), and " (quotation mark, delimiting attribute values), the characters must be escaped to prevent the browser from interpreting them as markup rather than displaying them as text.

HTML entities provide three syntactic formats for representing characters. Named entities use mnemonic names defined in the HTML specification: &lt; for <, &gt; for >, &amp; for &, &quot; for ", and &apos; for ' (the apostrophe entity, not universally supported in HTML4 but standard in HTML5 and XML). The HTML5 specification defines over 2,000 named entities covering mathematical symbols, Greek letters, currency symbols, arrows, and many other characters. Numeric entities reference Unicode code points directly: &#60; represents U+003C (less-than sign), while hexadecimal entities use the &#x prefix: &#x3C; represents the same character. Numeric and hexadecimal entities can represent any Unicode code point, including characters that have no named entity.

The security implications of HTML encoding are profound, particularly for preventing Cross-Site Scripting (XSS) attacks. XSS occurs when an attacker injects executable code (typically JavaScript) into a web page that other users view. The most common vector is inserting a script tag through user-generated content: if a comment field accepts "<script>alert('XSS')</script>" and displays it without encoding, the browser executes the script in the context of the page, potentially stealing session cookies, modifying page content, or redirecting users. Encoding the < and > characters as &lt; and &gt; neutralizes this attack because the browser displays the literal text instead of interpreting it as HTML tags.

Encoding strategy depends on the output context. In HTML body content, encoding the five critical characters (<, >, &, ", ') is sufficient. In HTML attribute values, additional characters may need encoding depending on the quoting style. In JavaScript contexts, HTML encoding alone is insufficient because the browser first interprets the JavaScript string before rendering any HTML entities. In URL contexts, percent-encoding (URL encoding) is required instead of HTML encoding. The OWASP (Open Web Application Security Project) recommends context-aware output encoding as the primary defense against XSS, where the encoding function used matches the output context. Server-side frameworks and templating engines increasingly provide automatic encoding by default, treating all dynamic content as untrusted and encoding it appropriately for the output context.