I have some Javascript code that communicates with an XML-RPC backend. The XML-RPC returns strings of the form:
Do you need to decode all encoded HTML entities or just &
itself?
If you only need to handle &
then you can do this:
var decoded = encoded.replace(/&/g, '&');
If you need to decode all HTML entities then you can do it without jQuery:
var elem = document.createElement('textarea');
elem.innerHTML = encoded;
var decoded = elem.value;
Please take note of Mark's comments below which highlight security holes in an earlier version of this answer and recommend using textarea
rather than div
to mitigate against potential XSS vulnerabilities. These vulnerabilities exist whether you use jQuery or plain JavaScript.