Which characters actually need escaping

Five. Everything else in an HTML document is data; these stop being data and become syntax.

Character	Named	Decimal	Hex	Where it has to be escaped
&	&	&	&	Everywhere. An unescaped ampersand starts a character reference, so "R&D" can swallow the text after it.
<	<	<	<	Everywhere. An unescaped less-than sign starts a tag, which is how text becomes markup.
>	>	>	>	In text. A greater-than sign is only ambiguous next to a tag, but escaping it costs nothing and avoids the edge cases.
"	"	"	"	Inside double-quoted attribute values, where an unescaped quote ends the value early.
'	'	'	'	Inside single-quoted attribute values, and in text that will be pasted into a JavaScript string.

An attribute is not a text node

The same string needs different escaping depending on where in the document it lands.

Text node: only & and < can break the parse. > is escaped here too, by convention.
Quoted attribute: the quote that opened the value also has to go, " or '. Escaping only < leaves the attribute closable, which is enough to add a new one.
Unquoted attribute: space, tab, newline, =, `, < and > all end the value. Quote your attributes; unquoted ones cannot be made safe by escaping five characters.
Inside <script> or <style>: HTML escaping does nothing. Raw-text elements do not decode character references, so & stays five literal characters.
In a URL: percent-encoding, not character references. See the URL encoder. A URL inside an attribute needs both.

Escaping is not sanitising

Escaping makes a string display as itself. Sanitising parses HTML you intend to keep and strips what you do not trust, which is what DOMPurify does. Escaped output is still exploitable in the wrong context, which is why the OWASP XSS cheat sheet is organised by context. In an application, use your template engine's escaping; a manual pass on top of it produces &amp;. This page is for the cases outside one: a data file, a CMS field, reading a payload.

Common problems

Double encoding: &amp; means the text was escaped twice, usually once by your code and once by the template engine. Unescape once here to see which layer to remove.
Missing semicolon: &copy decodes, &hellip does not. Only 106 of the 2,231 named references are valid without one. Browsers match the longest name and leave the rest as text, so &notit; is a not sign plus "it;". Same rule here.
Numbers 128 to 159:  gives an en dash, not a control character. The spec requires that range to be read as Windows-1252.
' is in HTML5 and XML but was never in HTML 4.01. Use ' if the output has to survive an old parser.

Frequently asked questions

What is the difference between an entity and a character reference?

& is a named character reference; "entity" is the older SGML and XML term for the same thing. The numeric forms have always been character references.

Will escaping stop cross-site scripting?

Only in the context it matches. The five characters are enough for a text node and a quoted attribute value, and do nothing for a script block, an unquoted attribute or a URL.

Should I escape every non-ASCII character?

Usually not. A file served as UTF-8 holds accents, CJK and emoji directly. Escape them when the output has to be pure ASCII: an old email template, a properties file, a system that mangles anything above code point 127. An emoji has no name, so it comes out numeric, escaped once as one code point rather than as two UTF-16 halves.

Which characters actually have to be escaped?

In text content, only three: the ampersand, the less-than sign, and the greater-than sign for safety. Inside a quoted attribute value, also the quote character in use. Everything else is optional, which is why the minimal mode exists and why escaping the whole alphabet is a habit worth dropping.