HTML-Entity-Encoder / Decoder/ & < > "

// Encode using a temporary DOM element (browser only)
function htmlEncode(str) {
  const div = document.createElement('div');
  div.appendChild(document.createTextNode(str));
  return div.innerHTML;
}

// Decode
function htmlDecode(str) {
  const div = document.createElement('div');
  div.innerHTML = str;
  return div.textContent ?? div.innerText;
}

// Manual encode (works in Node.js too)
const escapeHtml = (s) => s
  .replace(/&/g, '&')
  .replace(/</g, '&lt;')
  .replace(/>/g, '&gt;')
  .replace(/"/g, '&quot;')
  .replace(/'/g, '&#39;');

import html

# Encode (escape)
html.escape('<script>alert("xss")</script>')
# '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'

# Encode including single quotes
html.escape("it's", quote=True)
# 'it&#x27;s'

# Decode (unescape)
html.unescape('&lt;b&gt;Hello &amp; World&lt;/b&gt;')
# '<b>Hello & World</b>'

import "html"

// Encode
html.EscapeString("<script>alert('xss')</script>")
// "&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;"

// Decode
html.UnescapeString("&lt;b&gt;Hello &amp; World&lt;/b&gt;")
// "<b>Hello & World</b>"

// In templates (auto-escaped)
import "html/template"
t := template.Must(template.New("").Parse(
    "<p>{{.}}</p>"))
t.Execute(os.Stdout, "<b>Hello</b>")
// <p>&lt;b&gt;Hello&lt;/b&gt;</p>

<?php
// Encode
htmlspecialchars('<b>Hello</b> & "World"', ENT_QUOTES, 'UTF-8');
// '&lt;b&gt;Hello&lt;/b&gt; &amp; &quot;World&quot;'

// Decode
htmlspecialchars_decode('&lt;b&gt;Hello&lt;/b&gt;');
// '<b>Hello</b>'

// All HTML entities (including named ones)
htmlentities('© 2025 — Café', ENT_QUOTES, 'UTF-8');
// '&copy; 2025 &mdash; Caf&eacute;'

// Twig (auto-escaped by default)
// {{ user_input }}        ← auto-escaped
// {{ user_input|raw }}    ← raw HTML (unsafe!)