escapeHtml

Escapes the five characters that carry meaning in HTML, so a value can be dropped into a page as text rather than read as markup.

Character	Becomes
&	&
<	&lt;
>	&gt;
"	&quot;
'	&#39;

' is written as ' rather than ', which HTML 4 never defined and which therefore does not survive every parser. Python's built-in html.escape writes ' instead, so this function is not a wrapper around it.

Everything else is left alone, so text and emoji pass through untouched. & is part of the escaped set, which means an already-escaped string is escaped again: escapeHtml('<') returns '<'.

unescapeHtml turns the result back.

Parameters

Name	Type	Required	Default
text	stringStringstr	●	–
The string to escape. An empty or missing value returns an empty string.

Returns

string

String

str

Examples

escapeHtml('fred, barney, & pebbles'); // Returns 'fred, barney, & pebbles'
escapeHtml('<script>alert("x")</script>'); // Returns '&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;'
escapeHtml("it's"); // Returns 'it&#39;s'
escapeHtml('&lt;'); // Returns '&amp;lt;'

escapeHtml('fred, barney, & pebbles'); // Returns 'fred, barney, & pebbles'
escapeHtml('<script>alert("x")</script>'); // Returns '&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;'
escapeHtml("it's"); // Returns 'it&#39;s'
escapeHtml('&lt;'); // Returns '&amp;lt;'

escapeHtml('fred, barney, & pebbles')  # Returns 'fred, barney, & pebbles'
escapeHtml('<script>alert("x")</script>')  # Returns '&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;'
escapeHtml("it's")  # Returns 'it&#39;s'
escapeHtml('&lt;')  # Returns '&amp;lt;'