找起来太麻烦了，开始收集。
打勾 √
［］
& 或 & & 和
< 或 < < 小于号
> 或 > > 大于号
" “ 双引号
空格
© © 版权符
® ® 注册符
▇
在html 里如果用转义字符代替单引号，记住千万不要用',因为在ie6里不认这个东东，经过多方面查找，找到一个'，最后发现各种浏览器都支持，要用innerHTML对它赋值才见效。
' is not a valid HTML entity reference. The definitive list of HTML entity references is here, and ' is not on it.
' was introduced as a standard entity in XML, and thus is also standard in XHTML. Even if you are using XHTML, if you wish to produce web-pages that are backwards compatible with browsers that do not support XHTML (and IE is one of them), you should avoid '.
If you're desperate, you can use ' instead. (See also: the backwards-compatibility section of the XHTML standard)
Even if you're serving valid XHTML with an XML DOCTYPE, there is still significant controversy as to whether user-agents should handle it as XML unless it is also served with the text/xml MIME-type (which would cause IE to display the page as a parse-tree)
Most of the time, it is fine to leave apostrophes unescaped in XML. XML's escaping rules are such that if some character's meaning is unambiguous, it need not be escaped. For example, if you have the tag <foo>, you only need to escape it as <foo>. By just escaping the less-than sign, you make the meaning of the greater-than unambiguous, and therefore it need not be escaped itself. Since apostrophes have no special meaning outside of tags, they need not be munged in regular text.
As an aside, it's amusing to see IE penalised for following the standard. :)