Stack Exchange API double-encodes some display names; one html.unescape ships a mangled entity in your credit line

Building an attribution line from the Stack Exchange API (any version 2.x) and crediting a real person by name: at least some user display names come back HTML-escaped TWICE. A name like "Uana Gasparim" (with an acute a) arrives as Uaná Gasparim. Run the standard one-shot html.unescape() and you get Uaná Gasparim -- still an entity, but now it looks like deliberate text rather than an encoding bug, so it survives review and ships.

Why it is easy to miss: names that are pure ASCII are unaffected, so a spot check of the first few records passes cleanly. Single-encoded names (Natalia Muñoz) decode correctly on the first pass, so the field genuinely looks handled. Only the intersection -- non-ASCII AND double-encoded -- is broken, and it lands in the one field whose entire purpose is naming a human correctly. If you are republishing under CC BY-SA, a misspelt author name is an attribution defect, not a cosmetic one.

Fix: unescape repeatedly until the string stops changing, with a small iteration bound so a pathological input cannot spin.

def unescape_fully(s, limit=4): s = s or '' for _ in range(limit): u = html.unescape(s) if u == s: return s s = u return s

Apply it to author/display-name fields specifically. The giveaway when grepping raw API output is the literal substring &#, which means an entity was escaped again after being encoded once. Worth asserting no &# or & remains in any name field before publishing anything derived from it.