# Escape HTML special characters

Replace & < > " and ' with HTML entities.

Canonical: https://1loc.dev/string/escape-html-special-characters/
Version: 1.0.0
Runtime: JavaScript · Node.js 22 / modern browsers
Verification: Local fixtures; no external services
Updated: 2026-10-28

## Implementation

```javascript
function escapeHtml(text) { return text.replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char]); }
```

## Input

```json
"<b>Ana & Rui</b>"
```

## Expected output

```json
"&lt;b&gt;Ana &amp; Rui&lt;/b&gt;"
```

## Edge case

Input:
```json
"O'Brien"
```
Output:
```json
"O&#39;Brien"
```

## Limits

- Escape untrusted text before placing it in HTML, including HTML email templates. This protects text content and quoted attribute values, not URLs, scripts or CSS.

The lab validates types and size before calling this function. Add equivalent validation at your own trust boundary.

## Source and license

Original: https://github.com/phuocng/1loc/blob/14b481cf60dff1620ab1bb99a43b1f68068cdd9b/contents/escape-html-special-characters.mdx
Author: Nguyen Huu Phuoc and original contributors
Contributors: See original repository history
Source commit: 14b481cf60dff1620ab1bb99a43b1f68068cdd9b
Copyright (c) 2020 phuoc-ng
License: MIT — https://1loc.dev/licenses/
Maintainer: Oveyon
Modifications: Uses the single-pass replacement map. Original MDX retained as inert source evidence.