HTML unescape decodes entities safely (no script execution) · Shell wraps in single quotes · Regex/Shell unescape are best-effort · updates as you type