Escaping and Unescaping HTML

Implement without using the html module:

• escape(text, quote=True): replace & (first!), <, >, and when quote is true " → " and ' → '
• unescape(text): reverse those five entities plus numeric references like A and A; leave unknown entities untouched

Escaping user input before inserting it into HTML is the core defence against cross-site scripting (XSS).