Mention & operation order in comment (#21)

Co-authored-by: Sindre Sorhus <sindresorhus@gmail.com>

index.js

@@ -1,5 +1,7 @@
+// TODO: Use `String#replaceAll` when targeting Node.js 16.
+// Multiple `.replace()` calls are actually faster than using replacer functions #2.
 const _htmlEscape = string => string
-	.replace(/&/g, '&')
+	.replace(/&/g, '&') // Must happen first or else it will escape other just-escaped characters.
 	.replace(/"/g, '"')
 	.replace(/'/g, ''')
 	.replace(/</g, '&lt;')
@@ -10,7 +12,7 @@ const _htmlUnescape = htmlString => htmlString
 	.replace(/&lt;/g, '<')
 	.replace(/&#0?39;/g, '\'')
 	.replace(/&quot;/g, '"')
-	.replace(/&amp;/g, '&');
+	.replace(/&amp;/g, '&'); // Must happen last or else it will unescape other characters in the wrong order.
 
 export function htmlEscape(strings, ...values) {
 	if (typeof strings === 'string') {