Some terminology: A code like "&" is properly called a character entity reference; a code like "&" is a numeric character reference.
Together, we can refer to them all as "HTML entities." For a given code point, there is sometimes a character entity reference, but there is always a numeric character reference, which can be formed from the Unicode encoding of the character. For instance, ℛ has the numeric character reference "ℛ".
Generally it's the ASCII characters that have character entity references, but not always.
Character entity references are usually easier to read, but in a particular context a set of numeric character references might possibly be. For instance, if you were writing a regular expression to match a certain block of Unicode characters.
When you say "for validation purposes codes should be used," I think you have in mind the rule that a bare ampersand is not valid HTML. That's specific to this character.
Update
An example where you have to use the numeric character entity: There is no character entity reference for the single quote character, "'". A piece of JavaScript to scrub quote characters out of a string has to use the numeric character entity.