HTML entities encoder / decoder

For safely inserting user-provided text into HTML, you only need to escape five characters:

• & → & (must come first, or you double-escape later substitutions)
• < → <
• > → >
• " → " (only matters inside double-quoted attributes)
• ' → ' (only inside single-quoted attributes — we emit numeric for HTML4 safety)

That's the "Minimal" strategy in the encoder above. It's idiomatic for any modern templating pipeline and matches what frameworks like React, Vue and Astro produce automatically.

Beyond the five-character minimum, three styles are interchangeable:

• Named — ©, €, —. Most readable, but the named list is finite (~250 entries); rarer Unicode falls back to numeric.
• Numeric (decimal) — ©. Works for the entire Unicode range. Slightly less readable but universally supported.
• Hex — ©. Same coverage as decimal; preferred when you want hex codepoints to match Unicode tables verbatim.

Pick named for human-readable HTML, numeric for legacy email tooling, hex for documentation that lists Unicode code points alongside characters.

Most JavaScript entity-decode libraries ship a 100 KB table of every named entity. We use a single-line browser trick instead:

const ta = document.createElement("textarea");
ta.innerHTML = input;
return ta.value;

This delegates to the browser's actual HTML parser, so every entity it knows (named, numeric, hex) works automatically. Setting innerHTML on a textarea rather than a generic element avoids any script execution because <script> tags inside <textarea> are treated as text.

For most application code, your framework already escapes user content correctly when you interpolate ({value} in React/Astro, {{ value }} in Vue, \${value} in template literals via tagged-template helpers). Manual escaping is reserved for the small number of places where you assemble raw HTML strings — for example, server-rendered emails, RSS feeds, or static-site generators emitting one-off HTML snippets.