Answer by user123444555621 for What characters must be escaped in HTML 5?

From http://www.w3.org/html/wg/drafts/html/master/single-page.html#serializing-html-fragments

Escaping a string (for the purposes of the algorithm* above) consists of running the following steps:

1. Replace any occurrence of the "&" character by the string "&".
2. Replace any occurrences of the U+00A0 NO-BREAK SPACE character by the string " ".
3. If the algorithm was invoked in the attribute mode, replace any occurrences of the """ character by the string """.
4. If the algorithm was not invoked in the attribute mode, replace any occurrences of the "<" character by the string "&lt;", and any occurrences of the ">" character by the string "&gt;".

*Algorithm is the built-in serialization algorithm as called e.g. by the innerHTML getter.

Strictly speaking, this is not exactly an aswer to your question, since it deals with serialization rather than parsing. But on the other hand, the serialized output is designed to be safely parsable. So, by implication, when writing markup:

1. The & character should be replaced by &
2. Non-breaking spaces should be escaped as   (surprise!...)
3. Within attributes, " should be escaped as "
4. Outside of attributes, < should be escaped as < and > should be escaped as >

I'm intentionaly writing "should", not "must", since parsers may be able to correct violations of the above.