I am using node_save() to alter a node field, but HTML code is showing escaped
Drupal core does not modify the data you save in the database [*]. All filters are applied only when displaying the data - this ensures that you never loose any data.

Assuming that you are using Drupal 7, and that the field in question has filtered text enabled, then what is happening is that when you save your new field, you are not setting what the filter format should be - so it defaults to plain text. You need to set the format of the field when saving it. In your code, you would do this as follows:

$node-&gt;field_author_box[$lang][0]['value'] = $str;
$node-&gt;field_author_box[$lang][0]['format'] = 'full_html';
node_save($node);


[*] Though some contrib modules may do this. For instance WYSIWYG editors such as CKEditor do modify your data (though in that case only when using the UI).