The two options are almost exactly the same. Here are your two choices:
<html>This is <b>bold</b></html>
<html><![CDATA[This is <b>bold</b>]]></html>
In both cases, you have to check your string for special characters to be escaped. Lots of people pretend that CDATA strings don't need any escaping, but as you point out, you have to make sure that "]]>" doesn't slip in unescaped.
In both cases, the XML processor will return your string to you decoded.
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
