Brave Search

What's the right way to decode a string that has special HTML entities in it? [duplicate]

stackoverflow.com › questions › 7394748 › whats-the-right-way-to-decode-a-string-that-has-special-html-entities-in-it

This is my favourite way of decoding HTML characters. The advantage of using this code is that tags are also preserved.

function decodeHtml(html) {
    var txt = document.createElement("textarea");
    txt.innerHTML = html;
    return txt.value;
}

Example: http://jsfiddle.net/k65s3/

Input:

Entity:&nbsp;Bad attempt at XSS:<script>alert('new\nline?')</script><br>

Output:

Entity: Bad attempt at XSS:<script>alert('new\nline?')</script><br>

Answer from Rob W on Stack Overflow

Stack Overflow

stackoverflow.com › questions › 7394748 › whats-the-right-way-to-decode-a-string-that-has-special-html-entities-in-it

javascript - What's the right way to decode a string that has special HTML entities in it? - Stack Overflow

Top answer

1 of 7

603

This is my favourite way of decoding HTML characters. The advantage of using this code is that tags are also preserved.

function decodeHtml(html) {
    var txt = document.createElement("textarea");
    txt.innerHTML = html;
    return txt.value;
}

Example: http://jsfiddle.net/k65s3/

Input:

Entity:&nbsp;Bad attempt at XSS:<script>alert('new\nline?')</script><br>

Output:

Entity: Bad attempt at XSS:<script>alert('new\nline?')</script><br>

2 of 7

188

Don’t use the DOM to do this if you care about legacy compatibility. Using the DOM to decode HTML entities (as suggested in the currently accepted answer) leads to differences in cross-browser results on non-modern browsers.

For a robust & deterministic solution that decodes character references according to the algorithm in the HTML Standard, use the he library. From its README:

he (for “HTML entities”) is a robust HTML entity encoder/decoder written in JavaScript. It supports all standardized named character references as per HTML, handles ambiguous ampersands and other edge cases just like a browser would, has an extensive test suite, and — contrary to many other JavaScript solutions — he handles astral Unicode symbols just fine. An online demo is available.

Here’s how you’d use it:

he.decode("We&#39;re unable to complete your request at this time.");
→ "We're unable to complete your request at this time."

Disclaimer: I'm the author of the he library.

See this Stack Overflow answer for some more info.

javascript - HTML Entity Decode

javascript - Decode html entities with jquery

javascript - Prototype.js or other js function to decode html entities

javascript - How to decode HTML entities for XHTML application

javascript - Html Entity decode method

More results from stackoverflow.com

reddit.com › r/learnjavascript › how to decode html entities in javascript?

r/learnjavascript on Reddit: How to decode HTML entities in JavaScript?

May 19, 2021 -

I'm running a small database. As we all know, it's important to sanitize database input to prevent SQL injection. Therefore, I convert e.g ' and " to their corresponding HTML entities, e.g. ' for '.

This works fine when displaying text on a web page. Only now I need to show these data dynamically using JavaScript. How do I convert HTML entities to characters in JavaScript?

I've found a few workarounds, for example creating a hidden textarea and copypasta to a from it, but that seems wrong. Can it really be true that there is no such function in JavaScript?

Top answer

1 of 3

I don't see why you'd convert to HTML entities to deal with SQL injection. Why not simply use a prepared statement/parameterized query

2 of 3

I've had a really specific case with such a string- "Let\\'s be honest, weâ€™re messing it up". Nothing helped until I found out this solution. Hopefully it'll help someone in the future function decodeHtmlEntities(raw: string) { // 1) remove backslash escapes that precede &, ', " or backslash const unescaped = raw.replace(/\\(?=[&'"\\])/g, ""); // 2) decode HTML entities const decodedEntities = he.decode(unescaped); // 3) Try cp1252 -> utf8 roundtrip (this recovers sequences like E2 80 99) try { // encode the current JS string as cp1252 bytes, then interpret those bytes as utf8 const cp1252Bytes = iconv.encode(decodedEntities, "cp1252"); const fixed = cp1252Bytes.toString("utf8"); // heuristics: if it didn't produce replacement chars, prefer this if (!fixed.includes("\uFFFD")) return fixed; } catch (e) { // ignore and fall through to latin1 attempt } // 4) fallback: latin1 -> utf8 (works for many single-step mojibake cases) try { const buf = Buffer.from(decodedEntities, "latin1"); const fixed2 = buf.toString("utf8"); if (!fixed2.includes("\uFFFD")) return fixed2; } catch (e) { // ignore } // if nothing worked above, return entity-decoded value as last resort return decodedEntities; }

Videos

20:36

YouTube

ILLEGAL Source Code?! | Javascript Dataset Tutorial and How to ...

November 12, 2021

4.2K