Decode HTML entities in one pass

Content from a CMS or an RSS feed arrives entity-encoded, and you have to decode it before you can search it, count its characters, or send it somewhere that is not HTML. Doing it with repeated replaces creates a real security bug: decode & first and then scan again, and the input < turns into <, which the author explicitly escaped.

Implement unescapeHtml(input). It decodes, in a single left-to-right pass over the string, any entity matching &name;, { or .

The named entities you must support are exactly & to &, < to <, > to >, " to ", ' to ' and   to a normal space. Numeric entities are decimal (') or hexadecimal with a lower or upper case x (/), and decode with String.fromCodePoint of that value. Any entity you do not recognise — ½, &copyright; — is left in the output exactly as written.

Because it is one pass, text produced by decoding is never rescanned: "<" decodes to "<" and stops there. If input is null or undefined, return the empty string "".

What it has to do

• Decode &, <, >, ", ' and  , with   becoming a normal space.
• Decode decimal &#NN; and hexadecimal &#xNN; entities, case-insensitively on the x.
• Leave unrecognised entities untouched.
• Decode in a single pass, so < becomes < and not <.
• Return "" for null and undefined.

Your workspace