HTML Entity Encoder and Decoder

The default mode escapes five characters and nothing else: ampersand, less-than, greater-than, double quote and apostrophe. That is not minimalism, it is the correct answer — those five are what can change the structure of a document or break out of an attribute, and escaping more adds noise without adding safety. The ampersand has to be escaped first, before the others are introduced, or the entities produced by the later replacements get escaped a second time and you end up with < where you wanted <.

Named and numeric modes go further and escape every non-ASCII character, which is useful for a document that has to survive a pipeline with uncertain encoding. Named mode uses the HTML name where one exists — ©, —, é — and falls back to a numeric reference otherwise, because HTML5 defines over two thousand names and only a fraction appear in real documents. Characters outside the Basic Multilingual Plane, emoji among them, are escaped by code point rather than by their two UTF-16 halves; escaping the halves separately produces a pair of references that no parser will accept.

Worth being clear about what escaping does not do. It is context-dependent: the same string needs different treatment in HTML text, in an attribute, inside a script block, in a URL and in a CSS value, and HTML escaping in the last three protects nothing at all. Escaping on the way into storage rather than on the way out to a page is the other common mistake, because the stored value is then wrong for every other consumer.