Caratteri speciali HTML & Entità: Tabella di riferimento completa (2025)

HTML entities let you display reserved characters, symbols, and special glyphs that would otherwise be interpreted as HTML code. This complete HTML special characters and entities reference provides copy-paste-ready tables covering essential characters, currency symbols, math operators, arrows, Greek letters, and typographic marks.

Encode and decode HTML entities instantly with our HTML Escape / Unescape Tool →

What Are HTML Entities?

An HTML entity is a string that begins with & and ends with ;. It renders as a single character in the browser. Entities exist because certain characters are reserved in HTML (like < and >) or are not available on a standard keyboard (like • or ©).

Every entity can be written in three forms:

• Named entity — e.g. & (human-readable, but not every character has a name)
• Decimal numeric — e.g. & (works for any Unicode code point)
• Hexadecimal numeric — e.g. & (same coverage as decimal, shorter for large code points)

Essential Characters

These six characters are the most frequently used HTML entities. The first five are critical because they have special meaning in HTML syntax.

Currency Symbols

A comprehensive table of currency symbols used in international web development. Use these entities to ensure correct rendering regardless of font or encoding.

Math Symbols & Operators

Mathematical symbols commonly used in documentation, scientific content, and UI labels.

Arrows

Arrow characters for navigation, UI indicators, flow diagrams, and decorative purposes.

Greek Letters

Greek letters are widely used in mathematics, science, and engineering documentation. Both uppercase and lowercase forms are listed.

Typography & Punctuation

Typographic characters for professional-quality text rendering, including dashes, quotation marks, and legal symbols.

How to Use HTML Entities

You can use any of the three forms interchangeably in your HTML. Here are examples:

Named Entity (when available)

<p>Copyright &copy; 2025 My Company</p>
<!-- Renders: Copyright © 2025 My Company -->

Decimal Numeric Entity

<p>Copyright &#169; 2025 My Company</p>
<!-- Renders: Copyright © 2025 My Company -->

Hexadecimal Numeric Entity

<p>Copyright &#xA9; 2025 My Company</p>
<!-- Renders: Copyright © 2025 My Company -->

All three lines above render the same © symbol. Named entities are the most readable in source code, but numeric entities support every Unicode character, including emoji and CJK characters.

Best practice: Always escape <, >, &, and " in user-generated content to prevent XSS attacks. Use named entities in hand-written HTML for readability, and numeric entities in generated output for maximum compatibility.

<!-- Always escape user content to prevent XSS -->
<p>User said: &lt;script&gt;alert('xss')&lt;/script&gt;</p>

<!-- Use entities for special typography -->
<p>Price: &pound;19.99 &mdash; Limited offer</p>
<p>Temperature: 72&deg;F &plusmn; 2&deg;</p>
<p>&copy; 2025 Company&trade; &bull; All rights reserved</p>

<!-- Non-breaking spaces to keep units together -->
<p>The file is 4.5&nbsp;GB in size.</p>
<p>The speed limit is 100&nbsp;km/h.</p>

Escaping HTML in JavaScript

When inserting user-provided text into the DOM, you must escape HTML special characters to prevent Cross-Site Scripting (XSS) attacks. Here are reliable approaches:

Manual String Replacement

function escapeHtml(text) {
  const map = {
    '&': '&',
    '<': '&lt;',
    '>': '&gt;',
    '"': '&quot;',
    "'": '&#039;',
  };
  return text.replace(/[&<>"']/g, (char) => map[char]);
}

// Usage
const userInput = '<script>alert("xss")</script>';
const safe = escapeHtml(userInput);
// Result: "&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;"
document.getElementById('output').innerHTML = safe;

Using the DOM (Browser-Safe)

function escapeHtmlDOM(text) {
  const div = document.createElement('div');
  div.textContent = text;     // textContent auto-escapes
  return div.innerHTML;        // returns escaped HTML
}

// Usage
const escaped = escapeHtmlDOM('<img onerror="alert(1)">');
// Result: "&lt;img onerror=&quot;alert(1)&quot;&gt;"

Decoding Entities Back to Text

function decodeHtmlEntities(html) {
  const textarea = document.createElement('textarea');
  textarea.innerHTML = html;
  return textarea.value;
}

// Usage
const decoded = decodeHtmlEntities('<p>Hello & welcome</p>');
// Result: "<p>Hello & welcome</p>"

In React / JSX

React escapes text content by default. You only need to be careful with dangerouslySetInnerHTML:

// SAFE: React auto-escapes this
function SafeComponent({ userInput }) {
  return <p>{userInput}</p>;
  // <script> tags in userInput are rendered as text, not executed
}

// DANGEROUS: Only use with sanitized HTML
import DOMPurify from 'dompurify';

function RichContent({ htmlContent }) {
  const clean = DOMPurify.sanitize(htmlContent);
  return <div dangerouslySetInnerHTML={{ __html: clean }} />;
}

// Node.js / Server-Side (no DOM available)
function escapeHtmlNode(text) {
  return text
    .replace(/&/g, '&amp;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#039;');
}

Rule of thumb: Never use innerHTML or dangerouslySetInnerHTML with unsanitized user input. Always sanitize with a library like DOMPurify if you must render HTML from external sources.

Frequently Asked Questions

Do I need to use HTML entities for characters like é or ñ in UTF-8 pages?

No. If your page is served with <meta charset="UTF-8"> (which is the modern default), you can type accented characters directly. Entities are only required for HTML-reserved characters (< > & ") and characters not available on your keyboard.

What is the difference between   and a regular space?

A regular space (U+0020) can be collapsed by the browser — multiple spaces become one, and lines can break at spaces. A non-breaking space ( , U+00A0) prevents collapsing and prevents line breaks at that position. Use it to keep two words on the same line (e.g., "100 km") or to add extra spacing in HTML.

Can I use emoji as HTML entities?

Yes. Every emoji has a Unicode code point. For example, the rocket emoji can be written as 🚀 which renders as 🚀. However, modern browsers and UTF-8 encoding mean you can simply paste the emoji character directly.

Why does my HTML show & instead of & on the page?

This means the text has been double-escaped. The source code contains & instead of &. This commonly happens when a server or template engine escapes content that was already escaped. Check your rendering pipeline for redundant escaping steps.

Are HTML entities case-sensitive?

Yes, named entities are case-sensitive. &Amp; is not valid — it must be &. Similarly, Α (Α) and α (α) are different characters (uppercase vs lowercase Greek alpha). Numeric entities are case-insensitive for the x prefix: & and & both work.

Bookmark this page as your go-to reference for HTML entities. For quick encoding and decoding, use our tool below.

Encode / Decode HTML entities with our HTML Escape Tool →