Escapes the five HTML special characters (& < > " ') in a string, per
OWASP's XSS Prevention Cheat Sheet Rule #1 for HTML element content --
useful for safely rendering user-supplied text without pulling in a
dedicated escaping library.
This covers HTML element content only, not other injection contexts
(HTML attributes, <script> bodies, CSS, URLs) -- those need different,
context-specific encoding that this function doesn't provide. See
unescapeHtml for the reverse operation.
Parameters
text: string
Text to escape.
Returns string
The escaped string, or an error message for invalid input.
Escapes the five HTML special characters (
& < > " ') in a string, per OWASP's XSS Prevention Cheat Sheet Rule #1 for HTML element content -- useful for safely rendering user-supplied text without pulling in a dedicated escaping library.This covers HTML element content only, not other injection contexts (HTML attributes,
<script>bodies, CSS, URLs) -- those need different, context-specific encoding that this function doesn't provide. See unescapeHtml for the reverse operation.