title: Which are the HTML, and XML, special characters?
body: <p>What are the special reserved character entities in HTML and in XML?</p>
  
  <p>The information that I have says:</p>
  
  <p><strong>HTML:</strong></p>
  
  <ul>
  <li><code>&amp;</code> <em>(replace with <code>&amp;amp;</code>)</em></li>
  <li><code>&lt;</code> <em>(replace with <code>&amp;lt;</code>)</em></li>
  <li><strike><code>&gt;</code> <em>(replace with <code>&amp;gt;</code>)</em></strike></li>
  <li><code>"</code> <em>(replace with <code>&amp;quot;</code>)</em></li>
  <li><strike><code>'</code> <em>(replace with <code>&amp;apos;</code>)</em></strike></li>
  </ul>
  
  <p><strong>XML:</strong></p>
  
  <ul>
  <li><code>&lt;</code> <em>(replace with <code>&amp;lt;</code>)</em></li>
  <li><code>&gt;</code> <em>(replace with <code>&amp;gt;</code>)</em></li>
  <li><code>&amp;</code> <em>(replace with <code>&amp;amp;</code>)</em></li>
  <li><code>'</code> <em>(replace with <code>&amp;apos;</code>)</em></li>
  <li><code>"</code> <em>(replace with <code>&amp;quot;</code>)</em></li>
  </ul>
  
  <p>But I cannot find documentation on either of these.</p>
  
  <p>The W3C does mention, in <a href="http://www.w3.org/TR/2008/REC-xml-20081126/#sec-predefined-ent" rel="nofollow noreferrer">Extensible Markup Language (XML) 1.0 (Fifth Edition)</a>, certain predefined entity references. But it says that these entities are predefined (in the same way that <code>&amp;copy;</code> is predefined); not that they must be escaped:</p>
  
  <blockquote>
    <h2><a href="http://www.w3.org/TR/2008/REC-xml-20081126/#sec-predefined-ent" rel="nofollow noreferrer">4.6 Predefined Entities</a></h2>
    
    <p>[Definition: Entity and character references may both be used to
    <strong>escape</strong> the left angle bracket, ampersand, and other delimiters. A set
    of general entities (amp, lt, gt, apos, quot) is specified for this
    purpose. Numeric character references may also be used; they are
    expanded immediately when recognized and must be treated as character
    data, so the numeric character references " &amp;#60; " and " &amp;#38; " may
    be used to escape &lt; and &amp; when they occur in character data.]</p>
  </blockquote>
  
  <p>What characters <strong>must</strong> be escaped into entity references in <strong>HTML</strong>?
  What characters <strong>must</strong> be escaped into entity references in <strong>XML</strong>?</p>
  
  <hr>
  
  <p><strong>Update</strong>:</p>
  
  <p>From <a href="http://www.w3.org/TR/2008/REC-xml-20081126/#syntax" rel="nofollow noreferrer">Extensible Markup Language (XML) 1.0 (Fifth Edition)</a>:</p>
  
  <blockquote>
    <h2><a href="http://www.w3.org/TR/2008/REC-xml-20081126/#syntax" rel="nofollow noreferrer">2.4 Character Data and Markup</a></h2>
    
    <p>The ampersand character (<code>&amp;</code>) and the left angle bracket (<code>&lt;</code>) <strong>must not</strong>
    appear in their literal form, except when used as markup delimiters,
    or within a comment, a processing instruction, or a CDATA section.
    If
    they are needed elsewhere, they <strong>must</strong> be escaped using either numeric
    character references or the strings "<code>&amp;amp;</code>" and "<code>&amp;lt;</code>"
    respectively.</p>
    
    <p>The right angle bracket (<code>&gt;</code>) may be represented using the
    string "<code>&amp;gt;</code>", and <strong>must</strong>, for compatibility, be escaped using either
    "<code>&amp;gt;</code>" or a character reference when it appears in the string "<code>]]&gt;</code>"
    in content, when that string is not marking the end of a CDATA section.</p>
    
    <p>To allow attribute values to contain both single and double quotes, the apostrophe or single-quote character (<code>'</code>) may be represented as "<code>&amp;apos;</code>", and the double-quote character (<code>"</code>) as "<code>&amp;quot;</code>".</p>
  </blockquote>
  
  <p>I read the former as saying that</p>
  
  <p><strong>must be</strong>:</p>
  
  <ul>
  <li><code>&lt;</code> (<code>&amp;lt;</code>)  must be</li>
  <li><code>&amp;</code> (<code>&amp;amp;</code>) must be</li>
  </ul>
  
  <p><em>may</em>, but <strong>must</strong> when appearing as <code>]]&gt;</code></p>
  
  <ul>
  <li><code>&gt;</code> (<code>&amp;gt;</code>) must be, if appearing as <code>]]&gt;</code></li>
  </ul>
  
  <p>And that <code>'</code> and <code>"</code> don't have to be escaped at all; unless you want to have quotes inside quoted attributes.</p>
  
  <hr>
  
  <p>From <a href="http://www.w3.org/TR/html4/charset.html#entities" rel="nofollow noreferrer">HTML 4.01 Specification, HTML Document Representation</a>:</p>
  
  <blockquote>
    <h2><a href="http://www.w3.org/TR/html4/charset.html#h-5.3.2" rel="nofollow noreferrer">5.3.2 Character entity references</a></h2>
    
    <p>Authors wishing to put the "<code>&lt;</code>" character in text should use "<code>&amp;lt;</code>"
    (ASCII decimal 60) to avoid possible confusion with the beginning of a
    tag (start tag open delimiter).</p>
    
    <p>Similarly, authors should use "<code>&amp;gt;</code>"
    (ASCII decimal 62) in text instead of "<code>&gt;</code>" to avoid problems with older
    user agents that incorrectly perceive this as the end of a tag (tag
    close delimiter) when it appears in quoted attribute values.</p>
    
    <p>Authors should use "<code>&amp;amp;</code>" (ASCII decimal 38) instead of "<code>&amp;</code>" to avoid
    confusion with the beginning of a character reference (entity
    reference open delimiter). Authors should also use "<code>&amp;amp;</code>" in
    attribute values since character references are allowed within CDATA
    attribute values.</p>
    
    <p>Some authors use the character entity reference "<code>&amp;quot;</code>" to encode
    instances of the double quote mark (<code>"</code>) since that character may be
    used to delimit attribute values.</p>
  </blockquote>
  
  <p>HTML is much more wishy-washy on the rules, but it sounds like I <em>should</em>:</p>
  
  <ul>
  <li><code>&lt;</code> should be with <code>&amp;lt;</code></li>
  <li><code>&gt;</code> should be with <code>&amp;gt;</code></li>
  <li><code>&amp;</code> should be with <code>&amp;amp;</code></li>
  <li><code>"</code> should be with <code>&amp;quot;</code></li>
  </ul>
  
  <p>And if <code>"</code> can be an entity reference, I should also replace <code>'</code> with <code>&amp;amp;</code>.</p>
  
  <hr>
  
  <h2>Update Two</h2>
  
  <p>From <a href="http://www.w3.org/TR/html5/the-end.html#serializing-html-fragments" rel="nofollow noreferrer">HTML5 - A vocabulary and associated APIs for HTML and XHTML</a>:</p>
  
  <blockquote>
    <h2><a href="http://www.w3.org/TR/html5/the-end.html#serializing-html-fragments" rel="nofollow noreferrer">8.3 Serializing HTML fragments</a></h2>
    
    <p><strong>Escaping a string</strong> (for the purposes of the algorithm above) consists
    of running the following steps:</p>
    
    <p>Replace any occurrence of the "<code>&amp;</code>" character by the string "<code>&amp;amp;</code>".</p>
    
    <p>Replace any occurrences of the U+00A0 NO-BREAK SPACE character by the
    string "<code>&amp;nbsp;</code>".</p>
    
    <p>If the algorithm was invoked in the attribute mode, replace any
    occurrences of the "<code>"</code>" character by the string "<code>&amp;quot;</code>".</p>
    
    <p>If the algorithm was not invoked in the attribute mode, replace any
    occurrences of the "<code>&lt;</code>" character by the string "<code>&amp;lt;</code>", and any
    occurrences of the "<code>&gt;</code>" character by the string "<code>&amp;gt;</code>".</p>
  </blockquote>
  
  <p>Which I read as <strong>HTML</strong>:</p>
  
  <ul>
  <li><code>&amp;</code> by <code>&amp;amp;</code> always</li>
  <li><code></code> by <code>&amp;nbsp;</code> always</li>
  <li><code>"</code> by <code>&amp;quot;</code> if it's inside an attribute</li>
  <li><code>&lt;</code> by <code>&amp;lt;</code> if it's <strong>not</strong> in an attribute (i.e. attributes can contain <code>&lt;</code>)</li>
  <li><code>&gt;</code> by <code>&amp;gt;</code> if it's <strong>not</strong> in an attribute (i.e. attributes can contain <code>&gt;</code>)</li>
  </ul>