Escape and decode without handing your text to the HTML parser
Escape markup-critical characters, or decode named and numeric references back to text, using a lookup table and code-point arithmetic. Nothing is assigned to innerHTML, so a script tag in your input stays the literal characters of a script tag.