Skip to content
&🐐; Escape a string for use in HTML or the inverse
Branch: master
Clone or download
Pull request Compare This branch is even with sindresorhus:master.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.editorconfig
.gitattributes
.gitignore
.npmrc
.travis.yml
index.d.ts
index.js
index.test-d.ts
license
logo.jpg
package.json
readme.md
test.js

readme.md

escape-goat

Escape a string for use in HTML or the inverse

Build Status

Install

$ npm install escape-goat

Usage

const {htmlEscape, htmlUnescape, htmlEscapeTag, htmlUnescapeTag} = require('escape-goat');

htmlEscape('πŸ¦„ & 🐐');
//=> 'πŸ¦„ & 🐐'

htmlUnescape('πŸ¦„ & 🐐');
//=> 'πŸ¦„ & 🐐'

htmlEscape('Hello <em>World</em>');
//=> 'Hello &lt;em&gt;World&lt;/em&gt;'

const url = 'https://sindresorhus.com?x="πŸ¦„"';

htmlEscapeTag`<a href="${url}">Unicorn</a>`;
//=> '<a href="https://sindresorhus.com?x=&quot;πŸ¦„&quot;">Unicorn</a>'

const escapedUrl = 'https://sindresorhus.com?x=&quot;πŸ¦„&quot;';

htmlUnescapeTag`URL from HTML: ${url}`;
//=> 'URL from HTML: https://sindresorhus.com?x="πŸ¦„"'

API

htmlEscape(string)

Escapes the following characters in the given string argument: & < > " '

htmlUnescape(htmlString)

Unescapes the following HTML entities in the given htmlString argument: &amp; &lt; &gt; &quot; &#39;

htmlEscapeTag

Tagged template literal that escapes interpolated values.

htmlUnescapeTag

Tagged template literal that unescapes interpolated values.

Tip

Ensure you always quote your HTML attributes to prevent possible XSS.

FAQ

Why yet another HTML escaping package?

I couldn't find one I liked that was tiny, well-tested, and had both .escape() and .unescape().

License

MIT Β© Sindre Sorhus

You can’t perform that action at this time.