> Escape a string for use in HTML or the inverse

Install

``
$ npm install escape-goat
`

Usage

`js
import {htmlEscape, htmlUnescape} from 'escape-goat';

htmlEscape('🦄 & 🐐');
//=> '🦄 & 🐐'

htmlUnescape('🦄 & 🐐');
//=> '🦄 & 🐐'

htmlEscape('Hello World');
//=> 'Hello <em>World</em>'

const url = 'https://sindresorhus.com?x="🦄"';

htmlEscapeUnicorn;
//=> 'Unicorn'

const escapedUrl = 'https://sindresorhus.com?x="🦄"';

htmlUnescapeURL from HTML: ${escapedUrl};
//=> 'URL from HTML: https://sindresorhus.com?x="🦄"'
`

API

$3

Escapes the following characters in the given string argument: & < > " '

The function also works as a tagged template literal that escapes interpolated values.

$3

Unescapes the following HTML entities in the given htmlString argument: & < > " '`

The function also works as a tagged template literal that unescapes interpolated values.

Tip

Ensure you always quote your HTML attributes to prevent possible XSS.

FAQ

$3

I couldn't find one I liked that was tiny, well-tested, and had both escape and unescape methods.