Why HTML entities matter
Characters like <, > and & have special meaning in HTML. To display them literally (instead of the browser treating them as code), they must be written as entities: <, >, &. This is also a key defense against injection when displaying user input.
Encode before putting text into HTML; decode when reading entity-escaped content back.