Encode quotes in HTML body?

Question

Should I encode quotes (such as " and ' -> ” and ’) in my HTML body (e.g. convert <p>Matt's Stuff</p> to <p>Matt&rsquo;s Stuff</p>)? I was under the impression I should, but a co-worker said that it was no big deal. I'm dubious but I can't find anything that says it is verboten. Am I mistaken? Is it a best-practice to encode? Or is it simply useless?

Answer 1

Typicaly such isn't necessary unless you're placing such values into a tag's attribute (or other places where having quote marks would throw off parsing). In regular body text un-encoded will work fine.

<img src="..." alt="A &quot;quote mark&quot; in an alt attribute" />

Answer 2

No, you only need to use character references for quotes (single or double) if you want to use them inside an attribute value declaration that uses the same quotes for the value declaration:

title="The sign says "Matt's Stuff""
title='The sign says "Matt's Stuff"'

Both title values are The sign says "Matt's Stuff".

Answer 3

Encoding quotation marks (") is in practice only needed if the're inside an attribute, however for the HTML code to be correct (passing HTML validation), you should always encode quotation marks as ".

Apostrophes (') don't need escaping in HTML. In XHTML they should be encoded as '.

Answer 4

If you want your markup to be parsable as XML, you'll want to encode the following:

& => &
< => &lt;
> => &gt;
" => &quot;
' => &apos;

Definitely do this in attributes whether you're trying to make your code XML compliant or not.