# html-escape

> Escape string for use in html

Latest version **2.0.0** (published 2016-04-20) · Public Domain license · 0 weekly downloads

## Install

```sh
npm install html-escape
pnpm add html-escape
yarn add html-escape
bun add html-escape
```

## Health

**Score 23/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.0.0 |
| Published | 2016-04-20 |
| First published | 2013-10-17 |
| Weekly downloads | 0 |
| License | Public Domain |
| TypeScript types | separate (@types/html-escape) |
| Module format | CommonJS |
| Dependencies | 0 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 7 |
| Author | Parsha Pourkhomami |
| Maintainers | parshap |
| Keywords | html, html entities, escape, xss |

## Links

- npm: https://www.npmjs.com/package/html-escape
- Repository: https://github.com/parshap/html-escape
- Homepage: https://github.com/parshap/html-escape#readme
- Issues: https://github.com/parshap/html-escape/issues
- npm.io page: https://npm.io/package/html-escape

## Alternatives

- [@tsparticles/shape-image](https://npm.io/package/@tsparticles/shape-image.md) — 303.7K weekly downloads
- [@tsparticles/shape-line](https://npm.io/package/@tsparticles/shape-line.md) — 233.7K weekly downloads
- [stringify-attributes](https://npm.io/package/stringify-attributes.md) — 58.6K weekly downloads
- [mobile-drag-drop](https://npm.io/package/mobile-drag-drop.md) — 46.3K weekly downloads
- [@comunica/actor-rdf-parse-html](https://npm.io/package/@comunica/actor-rdf-parse-html.md) — 29.2K weekly downloads

## Recent versions

- 2.0.0 (latest) — 2016-04-20
- 1.0.2 — 2015-06-12
- 1.0.1 — 2013-10-17
- 1.0.0 — 2013-10-17

## README

# html-escape

Escape a string to be safe for use in html. `&`, `<`, `'`, and `"`
characters are replaced with with their [named character references][]:
`&amp;`, `&lt;`, `&apos;`, and `&quot;`. Escaped strings will be safe
for use in the following contexts:

 * [RCDATA][] and [DATA][html-data] (content of all elements except for
   `<script>` and `<style>`)
 * [Single-quoted attribute values][html-single-attribute] `'`
 * [Double-quoted attribute values][html-double-attribute] `"`

[named character references]: https://html.spec.whatwg.org/multipage/syntax.html#named-character-references
[html-data]: https://html.spec.whatwg.org/multipage/syntax.html#data-state
[rcdata]: https://html.spec.whatwg.org/multipage/syntax.html#rcdata-state
[html-single-attribute]: https://html.spec.whatwg.org/multipage/syntax.html#attribute-value-(single-quoted)-state
[html-double-attribute]: https://html.spec.whatwg.org/multipage/syntax.html#attribute-value-(double-quoted)-state

# Example

```js
var escape = require("html-escape");
var xssAttempt = "Hello <script>while(1);</script> world!";
// Output safe html
console.log("<p>" + escape(xssAttempt) + "</p>");
// "<p>Hello &lt;script>while(1);&lt;/script> world!</p>"
```

# Installation

```
npm install html-escape
```

---
_Source: https://npm.io/package/html-escape · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._