decodeHtml by Rob W

https://stackoverflow.com/questions/7394748/whats-the-right-way-to-decode-a-string-that-has-special-html-entities-in-it?answertab=active#tab-top

by denvdmj

HTML

<!-- Note: &amp;nbsp; is used to make sure that the value of the input is &nbsp; instead of a space. -->
<form id="form">
  <input type="text" id="input" placeholder="input" value="Entity:&amp;nbsp;
Bad attempt at XSS:<script>alert('new\nline?')</script><br>">
  <input type="submit" value="alert(input)"> In the above example, "&amp;nbsp;" should be replaced with a space, and the rest of the text should be displayed as-is. See http://stackoverflow.com/a/7394787/938089.
</form>

CSS

html {
  margin: 20px;
}

body {
  margin: 0 auto;
  width: 37em;
}

input {
  width: 100%;
  display: block;
}

JavaScript

function decodeHtml(html) {
  var txt = document.createElement('textarea');
  txt.innerHTML = html;
  return txt.value;
}

document.getElementById('form').onsubmit = function(e) {
  e.preventDefault();
  var input = document.getElementById('input').value;
  var output = decodeHtml(input);
  alert(output);
}