Escape <, >, &, quotes and optionally all non-ASCII characters as HTML entities.
Make text safe to show inside HTML by converting special characters to entities such as &lt; and &amp;.
<b>Tom & Jerry</b> becomes <b>Tom & Jerry</b> — shown on a page as the literal text rather than bold text.
Whenever you display user-supplied or code text inside HTML, so it’s shown as text instead of being interpreted as markup. This is also a key defence against cross-site scripting (XSS).
Not on a UTF-8 page. The option to encode all non-ASCII characters is for systems that can’t handle UTF-8.