Escape HTML

const escapeHtml = require('escape-html');

var escapeHtml = require('escape-html');

const escapeHtml = require('escape-html');

// Escape special HTML characters
const userInput = 'Hello <script>alert("XSS")</script> & "quotes"';
const safeHtml = escapeHtml(userInput);
console.log(safeHtml);
// Output: Hello &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt; &amp; &quot;quotes&quot;

// Works with any input type (coerced to string)
const numericInput = escapeHtml(123);
console.log(numericInput); // "123"

// Handles undefined and null
const emptyInput = escapeHtml(null);
console.log(emptyInput); // "null"

/**
 * Escape special characters in the given string of html.
 * 
 * @param {any} string - The input value to escape for HTML (will be coerced to string)
 * @returns {string} The escaped HTML string
 */
function escapeHtml(string);

const escapeHtml = require('escape-html');

// Basic HTML escaping
const userComment = 'I love <strong>bold</strong> text & "quotes"!';
const safeComment = escapeHtml(userComment);
// Result: I love &lt;strong&gt;bold&lt;/strong&gt; text &amp; &quot;quotes&quot;!

// Template integration
function renderTemplate(data) {
  return `<div class="comment">${escapeHtml(data.userInput)}</div>`;
}

// Safe attribute values
const title = 'Product "A" & Company\'s <special> item';
const safeTitle = escapeHtml(title);
// Use in: <img alt="${safeTitle}" />

// Type coercion examples
escapeHtml(42);          // "42"
escapeHtml(true);        // "true"
escapeHtml(undefined);   // "undefined"
escapeHtml({ a: 1 });    // "[object Object]"