Escape HTML special characters

Replace & < > " and ' with HTML entities.

JavaScript Version 1.0.0 · MIT · .md

function escapeHtml(text) { return text.replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char]); }

Input & expected output

"<b>Ana & Rui</b>"

"<b>Ana & Rui</b>"

The edge case

"O'Brien"

"O'Brien"

Know the limits

• Escape untrusted text before placing it in HTML, including HTML email templates. This protects text content and quoted attribute values, not URLs, scripts or CSS.

The function above is the implementation used by the lab. The lab validates JSON types and caps size before execution; include equivalent validation when accepting untrusted input in your application.

Keep exploring

• Capitalize a string — Uppercase the first Unicode code point and preserve the remaining text.
• Reverse a string — Reverse Unicode code points without splitting surrogate pairs.
• Check a palindrome — Compare a string with its code-point reversal.