If you insert raw HTML characters like < and > directly into web page content without escaping, the browser interprets them as HTML tags rather than literal characters. This can break your page layout and — more critically — create Cross-Site Scripting (XSS) security vulnerabilities if the content comes from user input. Always escape user-generated content before displaying it in HTML.

Both represent the less-than character (<). &lt; is a named entity — a human-readable shorthand defined in the HTML specification. &#60; is a numeric entity — it directly references the Unicode code point of the character (60 in decimal). Both are valid and render identically in browsers. Named entities are more readable; numeric entities work in any context regardless of whether named entities are supported.

Yes, when the content appears inside HTML attribute values. For example, <input value=”user’s name”> is fine, but <input value=”say “hello””> would break the attribute. Escaping the inner double quotes as &quot; fixes this. Inside regular text content between tags, escaping quotes is optional but harmless.

Cross-Site Scripting (XSS) is a security attack where malicious JavaScript is injected into a web page through unescaped user input. For example, if a user submits <script>alert(‘hacked’)</script> and it is displayed without escaping, the script executes in other users’ browsers. Escaping converts this to harmless text: &lt;script&gt;alert(‘hacked’)&lt;/script&gt;, which browsers display as literal characters, preventing execution.

Use HTML unescaping when you have received entity-encoded text that you want to read as plain characters. Common scenarios: converting escaped HTML from a database or API back to readable text for editing, processing escaped content in scripts before transformation, reviewing the actual content of HTML templates, or converting entities in metadata or RSS feeds to plain text.