HTML Character Entities Cheatsheet - HTML Special Characters Reference
In dynamically generated HTML, an unescaped ampersand or angle bracket quietly breaks the document, and in the wrong place it opens an XSS hole. The inverse problem is real too: a wall of & in someone source stops people from reading the template at all. This table classifies entities into basic characters, common symbols, currency, arrows, math, and Greek letters, giving both the named entity and the hexadecimal numeric form for each so you can choose by output target. The rule depends on where the string lands: named entities read better in HTML bodies, numeric &#x...; forms are safer inside JSON, JS strings, and older systems with limited character support, and when the document already declares UTF-8, writing the character directly is usually cleanest for symbols like ©, →, or α. Reach for it when sanitizing user input, assembling email templates, chasing mojibake, or moving a symbol between pages without losing its formatting.
Basic Characters 6
& or &< or <> or >" or "' or ' or  Common Symbols 7
© or ©® or ®™ or ™° or °± or ±× or ×÷ or ÷Currency Symbols 5
¢ or ¢£ or £¥ or ¥€ or €₹Arrow Symbols 5
← or ←↑ or ↑→ or →↓ or ↓↔ or ↔Math Symbols 8
∀ or ∀∃ or ∃∞ or ∞∑ or ∑√ or √≠ or ≠≤ or ≤≥ or ≥Greek Letters 7
α or αβ or βγ or γδ or δπ or πσ or σω or ωCommand Examples
Escape & < > in one fixed order so entities are not re-escaped
const line = 'a<b && c>d; "q"'
const safe = line
.replace(/&/g, '&')
.replace(/</g, '<')
.replace(/>/g, '>')
console.log(safe)The ampersand has to be first: if < were replaced before &, the ampersand it introduces would be rewritten again and the page would show &amp; instead of a bracket. The double quote is left alone here because it only needs escaping inside a double-quoted attribute value; for a " delimited attribute you would add one more replacement swapping the quote character for ".
Output
a<b && c>d; "q"
Reverse direction: decode named and numeric entities back to characters
python -c "import html; print(html.unescape('Tom & Jerry <3 © © α →'))"The most useful step when debugging mojibake is to confirm whether it was escaped twice. Both © and © decode to ©, both α and α decode to α. If literal & text is still on screen after unescape, an upstream layer already escaped once: fix it there instead of decoding a second time here.
Output
Tom & Jerry <3 © © α →
Find a missing semicolon or a bare unescaped & with grep -P
printf 'a & b © c © d €
' > page.html
grep -oP '&[#a-zA-Z0-9]+;?' page.html
grep -nP '&(?!amp;|lt;|gt;|quot;|apos;|nbsp;|copy;|reg;|trade;|deg;|plusmn;|times;|divide;|cent;|pound;|yen;|euro;|larr;|uarr;|rarr;|darr;|harr;|forall;|exist;|infin;|sum;|radic;|ne;|le;|ge;|alpha;|beta;|gamma;|delta;|pi;|sigma;|omega;|#[0-9]+;|#x[0-9a-fA-F]+;)' page.htmlThe first command lists every entity-shaped fragment so a missing semicolon like © stands out. The second is a negative assertion: anything starting with & that is not in the allow-list is either an unknown name, a missing semicolon, or a bare unescaped ampersand. Extend the allow-list with the entities your project actually uses, otherwise valid ones get flagged too.
Output
& © © € 1:a & b © c © d €
Derive numeric entities from code points, decimal and hex in one pass
node -e "
for (const ch of ['©', '€', 'α', '→', '∞']) {
console.log(ch, '&#' + ch.codePointAt(0) + ';', '&#x' + ch.codePointAt(0).toString(16) + ';')
}
"The decimal forms listed under currency, arrows and Greek letters are produced exactly this way: the code point is the decimal number, and converting that number to hex gives the x form. The code point is the part worth remembering, not the syntax — © equals © and € equals €, so for a symbol missing from the table, deriving it on the spot beats looking it up.
Output
© © © € € € α α α → → → ∞ ∞ ∞
Common Pitfalls
- Leaving & < > unescaped lets the data decide the page structure: a single unescaped < in user input can forge a tag or an attribute, which is the canonical XSS entry point.
- Escape the ampersand first. A per-character pass that handles < before & rewrites the & it just introduced, producing &amp; and literal entity text on screen.
- Always emit the semicolon in machine-readable output (JSON, JS strings, mail templates); the unterminated © form is swallowed or truncated by some older parsers and by any second processing pass.
- carries the meaning "do not break here", not spacing. Used as margin it scatters layout rules into body text and gets announced by screen readers; use CSS gap or margin for real gaps.
- Escape once. Running an already-escaped string through the escaper again turns & into &amp;, so check whether an upstream layer already escaped before rendering.
Tips
- In HTML, < > & must use entities, or they're parsed as tags or entity starts.
- Numeric entities (&#num;) have broader compatibility; named entities (&name;) read better.
- To prevent XSS, escape user input into entities before displaying.
- Modern frameworks (React, Vue) escape by default, but dangerouslySetInnerHTML and v-html need manual handling.
FAQ
Within one batch of HTML, when do I use named entities and when numeric ones?
Decide by output target, not by habit. Named entities (&, ©, →) go in HTML body text: the meaning is spelled out and diffs stay readable. Numeric entities (&, ©, →) go into JSON, JS string literals, or legacy systems with a narrow character set, because they do not depend on the parser knowing a particular name. If the page already declares UTF-8, writing ©, →, α directly is the simplest form and entities are only the fallback.
Why must the ampersand be escaped first?
Because the ampersand is the character that opens every entity, so the replacement has to run in one fixed order: turn every & into & first, then handle < and >. If you replace per character and touch < before &, the text you already produced gets hit again by the next rule and & becomes &amp;, so the page renders a literal < instead of a bracket. Double-escaping user input that was escaped once produces the same pollution.
Can be used as a spacing tool in layout?
No. It is a non-breaking space ( ), and its job is to forbid a line break at that position: between a name and its suffix, between a number and its unit, inside short labels that must not wrap. Using it as margin or gap scatters layout rules into body text, and screen readers announce the extra non-breaking space. Use CSS gap or margin for pure visual spacing, and reach for only when a break must be prevented.
What is the risk of writing &copy without the trailing semicolon?
The risk is not modern parsers but mixed sources. The semicolon is the only reliable terminator; HTML5 parsers do fall back for some unterminated forms, but as soon as the text passes through a regex, a template engine, a mail client, or an older XML parser, the missing semicolon can be swallowed as literal text or cut short. The rule is simple: always emit the semicolon in machine-readable output, and if you do omit it in prose, make sure the next character cannot extend the entity name — &copycat would parse as &copy followed by cat.
Beyond & itself, why are &lt; and &gt; mandatory escapes?
They are not typographic characters, they are the syntax of HTML itself. An unescaped < is read as the start of a tag, so the following text either disappears or turns into attributes; an unescaped > can close a tag early in some contexts. The page structure deforms and tag boundaries start being decided by data, which is the classic XSS entry point when user input is concatenated into HTML. Whether " (") and ' (') must be escaped depends on context: inside a double-quoted attribute value the double quote is mandatory, while a single quote can stay literal inside such an attribute.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us