DO NOT USE unescape-html OR escape-goat TO UNESCAPE UN-TRUSTED HTML! Only use safe libraries like fast-escape-html or html-escaper that only look up and replace the entire input once.