Which characters must be escaped in HTML?

< and & always, because they start a tag and an entity. Inside an attribute value you must also escape the quote character that delimits it. > is escaped by convention rather than necessity. Those four cover essentially every correctness and injection problem in markup.

Do I still need entities for accented characters?

Not if your page declares UTF-8, which every page should. You can write é directly. Entities remain useful for characters that are invisible or ambiguous in source — a non-breaking space, a zero-width joiner, a character your editor might normalise away.

Is escaping enough to prevent XSS?

In an HTML text node, yes. Elsewhere, no — a value inside a script block, a style block, or a URL attribute needs the escaping rules for that context, and HTML entity encoding alone will not save you. Escape according to where the value lands.

HTML Entity Encoder

Convert characters to HTML entities or decode entities back to characters. Escapes the four that matter for safety — < > & and quotes — plus accented and special characters. Both directions run in your browser.

Runs in your browser — nothing is uploaded

Questions

Which characters must be escaped in HTML?: < and & always, because they start a tag and an entity. Inside an attribute value you must also escape the quote character that delimits it. > is escaped by convention rather than necessity. Those four cover essentially every correctness and injection problem in markup.
Do I still need entities for accented characters?: Not if your page declares UTF-8, which every page should. You can write é directly. Entities remain useful for characters that are invisible or ambiguous in source — a non-breaking space, a zero-width joiner, a character your editor might normalise away.
Is escaping enough to prevent XSS?: In an HTML text node, yes. Elsewhere, no — a value inside a script block, a style block, or a URL attribute needs the escaping rules for that context, and HTML entity encoding alone will not save you. Escape according to where the value lands.