Decode HTML Escape Characters: Turning Escapes Back Into Text

Telling the schemes apart

<  &  é  →     -> HTML entities
%3C   %26    %C3%A9              -> URL percent-encoding
< \x26  \n                  -> JavaScript / JSON escapes

The prefix identifies the scheme: & for HTML, % for URLs, \ for JavaScript. Applying the wrong decoder leaves the text unchanged, which is a useful diagnostic in itself.

Decoding HTML escapes

Use the platform decoder rather than a replacement chain, so numeric and named forms are both covered:

html.unescape(s)                                    # Python
html_entity_decode($s, ENT_QUOTES|ENT_HTML5, 'UTF-8')   // PHP
new DOMParser().parseFromString(s,'text/html').documentElement.textContent  // JS

Layered escaping

Values often pass through several layers: a URL parameter inside an HTML attribute inside a JSON response. Decode from the outside in, one layer at a time, and stop when the text is readable.

%26amp%3B is percent-encoding wrapped around an HTML entity — URL-decode first to get &, then HTML-decode to get &. Doing it in the wrong order produces nonsense.

Do not over-decode

Decode exactly the layers that are actually present. Running an extra pass because the result "still has escapes" is how <script> becomes an executable tag.

And re-escape for whatever context the text goes into next — decoding removes the protection that was there, so text destined for HTML must be escaped again on output.