title: Decode text prior to $("#textbox").val() call?
body: <p>My web page makes AJAX calls to a server and displays the result in the browser. The contents of the result will frequently contain a portion of the text string that the user submitted in the AJAX request. So if the user types <code>&lt;script&gt;</code> in his query, the returned output will likely contain the phrase <code>&lt;script&gt;</code> too. The server encodes the response before sending it, however, so the returned phrase actually would be received as <code>&amp;lt;script&amp;gt;</code></p>
  
  <p>This is all well and good. The scripting vulnerability is removed and the browser properly displays <code>&lt;script&gt;</code> when showing the response. </p>
  
  <p>The problem is when I want to take the return value and stuff it into a text box. Consider:</p>
  
  <pre><code>$(“#someTextBox”).val(“&amp;lt;script&amp;gt;”);
  </code></pre>
  
  <p>The contents of the text box are displayed in encoded form (i.e. <code>&amp;lt;script&amp;gt;</code>) instead of in decoded form (i.e. <code>&lt;script&gt;</code>).</p>
  
  <p>Questions:</p>
  
  <p>[1] How do I decode the value prior to the call to val()?</p>
  
  <p>[2] Am I introducing a security vulnerability by doing so?</p>