feat(text): add unescapeHtml function

Reverses HTML entity escaping, converting named entities and numeric
character references back to their original characters.

Author: hey-amanthakur

text/unescape_html.ts

@@ -0,0 +1,35 @@
+// Copyright 2018-2026 the Deno authors. MIT license.
+// This module is browser compatible.
+
+const HTML_UNESCAPE_MAP: Record<string, string> = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&#39;": "'",
+  "&#x27;": "'",
+  "&#x2F;": "/",
+};
+
+const HTML_UNESCAPE_REGEXP = /&(?:amp|lt|gt|quot|#(?:39|x27|x2F));/g;
+
+/**
+ * Unescapes HTML special characters in a string.
+ *
+ * @param input The string to unescape
+ * @returns The unescaped string
+ *
+ * @example Usage
+ * ```ts
+ * import { unescapeHtml } from "@std/text/unescape-html";
+ * import { assertEquals } from "@std/assert";
+ *
+ * assertEquals(unescapeHtml("&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;"), "<script>alert('xss')</script>");
+ * ```
+ */
+export function unescapeHtml(input: string): string {
+  return input.replace(
+    HTML_UNESCAPE_REGEXP,
+    (entity) => HTML_UNESCAPE_MAP[entity]!,
+  );
+}

text/unescape_html_test.ts

@@ -0,0 +1,23 @@
+// Copyright 2018-2026 the Deno authors. MIT license.
+
+import { assertEquals } from "@std/assert";
+import { unescapeHtml } from "./unescape_html.ts";
+
+Deno.test("unescapeHtml() unescapes HTML entities", () => {
+  assertEquals(
+    unescapeHtml("<script>alert('xss')</script>"),
+    "<script>alert('xss')</script>",
+  );
+});
+
+Deno.test("unescapeHtml() unescapes ampersand", () => {
+  assertEquals(unescapeHtml("a &amp; b"), "a & b");
+});
+
+Deno.test("unescapeHtml() handles strings without entities", () => {
+  assertEquals(unescapeHtml("hello"), "hello");
+});
+
+Deno.test("unescapeHtml() handles empty string", () => {
+  assertEquals(unescapeHtml(""), "");
+});