title: How to handle possibly HTML encoded values in javascript
body: <p>I have a situation where I'm not sure if the input I get is HTML encoded or not. How do I handle this? I also have jQuery available.</p>
  
  <pre><code>function someFunction(userInput){
      $someJqueryElement.text(userInput);
  }
  
  // userInput "&lt;script&gt;" returns "&amp;lt;script&amp;gt;", which is fine
  // userInput "&amp;lt;script&amp;gt;" returns &amp;amp;lt;script&amp;amp;gt;", which is bad
  </code></pre>
  
  <p>I could avoid escaping ampersands (<code>&amp;</code>), but what are the risks in that? Any help is very much appreciated!</p>
  
  <p><strong>Important note:</strong>  This user input is not in my control. It returns from a external service, and it is possible for someone to tamper with it and avoid the html escaping provided by that service itself.</p>