Escape special characters as HTML entities or decode named, decimal and hexadecimal entities back to text.
HTML entities are text sequences such as <, & or © that represent characters which would otherwise be interpreted as markup or are hard to type. The browser displays them as the actual characters.
In text and attribute values you should escape & as &, < as <, > as >, " as " and ' as '. Escaping these prevents broken markup and is a key defence against XSS when inserting user input into a page.
Modern UTF-8 pages can contain characters like ç, € or emoji directly. Numeric entities such as ç are useful when the target system, email template or legacy file only supports ASCII.
It decodes all named HTML5 entities (like , €, …) using the browser's own parser, plus decimal (€) and hexadecimal (€) numeric entities. Decoding is done in a single pass, so &lt; correctly becomes < rather than <.