FIELD NOTES
Why HTML entities matter
Entities represent characters that otherwise have structural meaning in HTML. Escaping them lets code examples and literal symbols display as text.
Entity encoding alone is not a complete XSS defense. Applications must escape values for the exact HTML, attribute, URL or script context.