Escape or unescape HTML entities: < > & " ' become < > & " ' and back, with named and numeric forms both understood in the decode direction.
Escaping is the difference between displaying user text and executing it: the five characters above are the complete set that matters for HTML text content and attribute values, and numeric references let you round-trip any Unicode code point.
Frequently asked questions
Why five characters and not more?
In text content only < and & strictly need escaping (plus > for safety); inside double-quoted attributes add ". The quote set covers both contexts — escaping more is harmless but noisy.
Is this the same as URL encoding?
No — HTML entities protect markup from being parsed; percent-encoding protects URL syntax. Use each in its own layer (see the cURL-to-code article for the URL side).
中文说明
HTML 实体的转义与还原：< > & " ' 与 < > & " ' 互转，解码方向同时识别命名实体与数字实体。
转义是“显示用户文本”与“执行用户文本”的分界线：上述五个字符就是 HTML 文本内容与属性值需要处理的完整集合，数字引用还能让任意 Unicode 码点往返无损。
常见问题
为什么是这五个字符？
文本内容里严格必需转义的只有 < 和 &（> 是保险起见）；双引号属性值里再加 "。这五个覆盖两种上下文——多转无害但添噪。
这和 URL 编码是一回事吗？
不是——HTML 实体保护标记语言不被解析；百分号编码保护 URL 语法。各管各的层（URL 那一侧见 cURL 转代码一文）。