Unescape HTML entities in JavaScript?

Most answers given here have a huge disadvantage: if the string you are trying to convert isn’t trusted then you will end up with a Cross-Site Scripting (XSS) vulnerability. For the function in the accepted answer, consider the following: htmlDecode(“<img src=”https://stackoverflow.com/questions/3700326/dummy” onerror=”alert(/xss/)”>”); The string here contains an unescaped HTML tag, so instead of decoding anything … Read more