Usage no npm install needed!

<script type="module">
  import htmlEscape from 'https://cdn.skypack.dev/html-escape';
</script>

README

html-escape

Escape a string to be safe for use in html. &, <, ', and " characters are replaced with with their named character references: &, <, ', and ". Escaped strings will be safe for use in the following contexts:

RCDATA and DATA (content of all elements except for <script> and <style>)
Single-quoted attribute values '
Double-quoted attribute values "

Example

var escape = require("html-escape");
var xssAttempt = "Hello <script>while(1);</script> world!";
// Output safe html
console.log("<p>" + escape(xssAttempt) + "</p>");
// "<p>Hello &lt;script>while(1);&lt;/script> world!</p>"

Installation

npm install html-escape