title: OWASP html sanitizer - Why does it unescape some entities?
body: <p>I'm new to Owasp and it's HTML sanitizer, and find that with any policy I use, it's <em>unescaping</em> some entities back into characters.</p>
  
  <p>For example this string:</p>
  
  <pre><code>&amp;#64; test &amp;#33;
  </code></pre>
  
  <p>gets turned into this:</p>
  
  <pre><code>&amp;#64; test !
  </code></pre>
  
  <p>I'd like to leave the entities "as is" as much as possible. I'd even understand it if it was escaping them, and not unescaping them.</p>
  
  <p>So is this possible with the sanitizer? It seems to do it no matter what I try and use for a policy.</p>
  
  <p>Here's the code I'm running for my simple test:</p>
  
  <pre><code>package com.my.company.test;
  
  import org.junit.Test;
  import org.owasp.html.PolicyFactory;
  import org.owasp.html.Sanitizers;
  
  import junit.framework.TestCase;
  
  public class OwaspSanitizerTest extends TestCase {
    public static final PolicyFactory POLICY = Sanitizers.IMAGES;
  
    @Test
    public static final void testTextFilter() throws Exception {
        String data = "&amp;#64; test &amp;#33;";
        String result = POLICY.sanitize(data);
  
        System.out.println(result);
  
        assertEquals("&amp;#64; test &amp;#33;", result);
    }
  }
  </code></pre>
  
  <p>EDIT: The reason I ask is that I want my users inputs to match what we output as much as possible. I understand that this won't be possible in some situations, but would've expected it would be in this case.</p>