# escape-goat

> Escape a string for use in HTML or the inverse

Latest version **4.0.0** (published 2021-04-16) · MIT license · 0 weekly downloads

## Install

```sh
npm install escape-goat
pnpm add escape-goat
yarn add escape-goat
bun add escape-goat
```

## Health

**Score 38/100 (D)** — status: abandoned.

Positive: has types package; esm support; no vulnerabilities; high quality score.

Warnings: low downloads.

Negative: abandoned.

## Facts

| | |
|---|---|
| Version | 4.0.0 |
| Published | 2021-04-16 |
| First published | 2017-05-27 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/escape-goat) |
| Module format | ESM |
| Node | >=12 |
| Dependencies | 0 |
| Unpacked size | 6.1 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 552 |
| Author | Sindre Sorhus |
| Maintainers | sindresorhus |
| Keywords | escape, unescape, html, entity, entities, escaping, sanitize, sanitization, utility, template, attribute, value, interpolate, xss, goat, 🐐 |

## Links

- npm: https://www.npmjs.com/package/escape-goat
- Repository: https://github.com/sindresorhus/escape-goat
- Homepage: https://github.com/sindresorhus/escape-goat#readme
- Issues: https://github.com/sindresorhus/escape-goat/issues
- Funding: https://github.com/sponsors/sindresorhus
- npm.io page: https://npm.io/package/escape-goat

## Alternatives

- [@tsparticles/shape-image](https://npm.io/package/@tsparticles/shape-image.md) — 303.7K weekly downloads
- [@tsparticles/shape-line](https://npm.io/package/@tsparticles/shape-line.md) — 233.7K weekly downloads
- [stringify-attributes](https://npm.io/package/stringify-attributes.md) — 58.6K weekly downloads
- [mobile-drag-drop](https://npm.io/package/mobile-drag-drop.md) — 46.3K weekly downloads
- [@comunica/actor-rdf-parse-html](https://npm.io/package/@comunica/actor-rdf-parse-html.md) — 29.2K weekly downloads

## Recent versions

- 4.0.0 (latest) — 2021-04-16
- 3.0.0 — 2020-01-15
- 2.1.1 — 2019-09-23
- 2.1.0 — 2019-05-30
- 2.0.0 — 2019-04-17
- 1.3.0 — 2017-07-31
- 1.2.0 — 2017-07-21
- 1.1.0 — 2017-05-31
- 1.0.1 — 2017-05-28
- 1.0.0 — 2017-05-27

## README

<h1>
	<img src="logo.jpg" width="1280" alt="escape-goat">
</h1>

> Escape a string for use in HTML or the inverse

## Install

```
$ npm install escape-goat
```

## Usage

```js
import {htmlEscape, htmlUnescape} from 'escape-goat';

htmlEscape('🦄 & 🐐');
//=> '🦄 &amp; 🐐'

htmlUnescape('🦄 &amp; 🐐');
//=> '🦄 & 🐐'

htmlEscape('Hello <em>World</em>');
//=> 'Hello &lt;em&gt;World&lt;/em&gt;'

const url = 'https://sindresorhus.com?x="🦄"';

htmlEscape`<a href="${url}">Unicorn</a>`;
//=> '<a href="https://sindresorhus.com?x=&quot;🦄&quot;">Unicorn</a>'

const escapedUrl = 'https://sindresorhus.com?x=&quot;🦄&quot;';

htmlUnescape`URL from HTML: ${escapedUrl}`;
//=> 'URL from HTML: https://sindresorhus.com?x="🦄"'
```

## API

### htmlEscape(string)

Escapes the following characters in the given `string` argument: `&` `<` `>` `"` `'`

The function also works as a [tagged template literal](https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Template_literals#Tagged_template_literals) that escapes interpolated values.

### htmlUnescape(htmlString)

Unescapes the following HTML entities in the given `htmlString` argument: `&amp;` `&lt;` `&gt;` `&quot;` `&#39;`

The function also works as a [tagged template literal](https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Template_literals#Tagged_template_literals) that unescapes interpolated values.

## Tip

Ensure you always quote your HTML attributes to prevent possible [XSS](https://en.wikipedia.org/wiki/Cross-site_scripting).

## FAQ

### Why yet another HTML escaping package?

I couldn't find one I liked that was tiny, well-tested, and had both escape and unescape methods.

---
_Source: https://npm.io/package/escape-goat · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._