decode html front-end http://jsfiddle.net/k65s3/ http://stackoverflow.com/a/7394787/938089

main.css

input {
    width: 100%;
    display: block;
}

main.html

<!-- Note: &amp;nbsp; is used to make sure that the value of the input is &nbsp; instead of a space. -->
<form id="form">
    <input type="text" id="input" placeholder="input" value="Entity:&amp;nbsp;
Bad attempt at XSS:<script>alert('new\nline?')</script><br>">
<input type="submit" value="alert(input)">
In the above example, "&amp;nbsp;" should be replaced with a space, and the rest of the text should be displayed as-is. See http://stackoverflow.com/a/7394787/938089.
</form>

main.js

function decodeHtml(html) {
    var txt = document.createElement("textarea");
    txt.innerHTML = html;
    return txt.value;
}
document.getElementById('form').onsubmit = function(e) {
    e.preventDefault();
    var input = document.getElementById('input').value;
    var output = decodeHtml(input);
    alert(output);
}