In more detail
An entity starts with & and ends with ;. It comes in three forms: a named entity such as & or ©, a decimal numeric reference such as ©, and a hexadecimal one such as ©. All three are the same character here, the copyright sign, code point 169 (hex A9) in Unicode. &, < and > must be written as &, < and > in text, and " is needed for a double quote inside a double-quoted attribute. Escaping user input this way is the main defence against cross-site scripting (Cross-site scripting (XSS)). See the HTML Entities Cheat Sheet.
Why it matters
If a page prints user-supplied text without escaping it, the browser treats <script> as markup instead of text, which is exactly how injection happens. The opposite error is also common: escaping twice turns & into &amp;, and visitors then see the literal text &. Escape once, at output time, using the rule for the context (element text and attribute values differ from JavaScript or URLs).
Example
The text <a href="x">Tom & Jerry</a> is shown literally on a page when written as:
<a href="x">Tom & Jerry</a>
A visitor sees <a href="x">Tom & Jerry</a> as plain text and nothing is executed. Convert text either way with the HTML Entity Encode and HTML Entity Decode.
Common confusion
HTML entities are not URL percent-encoding: in a query string & is written %26, while in HTML text it is &.