node.js - escape html special characters

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
// Note: if you are looking for optimal solution check this snippet: https://dirask.com/snippets/Node-js-escape-HTML-special-characters-DKgEnD


const HTML_RULES = [
    { expression: /&/g, replacement: '&'  }, // keep this rule at first position
    { expression: /</g, replacement: '&lt;'   },
    { expression: />/g, replacement: '&gt;'   },
    { expression: /"/g, replacement: '&quot;' },
    { expression: /'/g, replacement: '&#039;' } // or  &#39;  or  &#0039;
                                                // &apos;  is not supported by IE8
                                                // &apos;  is not defined in HTML 4
];

const escapeHtml = (html) => {
    let result = html;
    for (const rule of HTML_RULES) {
        result = result.replace(rule.expression, rule.replacement);
    }
    return result;
};


// Usage example:

console.log(escapeHtml('<div class="message">Hi!</div>'));  // &lt;div class=&quot;message&quot;&gt;Hi!&lt;/div&gt;


// Output:
//
//     &lt;div class=&quot;message&quot;&gt;Hi!&lt;/div&gt;

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
// Note: in this snippet you can find quite optimal solution to escape HTML special characters.

// Hint: you can try to speed up source code much more by updating `escapeHtml()` function.
//
//       from:
//       ```
//           for (const character of html) {
//               ...
//       ```
//
//       to:
//       ```
//           for (let i = 0; i < html.length; ++i) {
//               const character = html[i];
//               ...
//       ```


const escapeHtml = (html) => {
    let result = '';
    for (const character of html) {
        switch (character) {
            // Warning: do not change cases order
            case '&':  result += '&amp;';  break;
            case '<':  result += '&lt;';   break;
            case '>':  result += '&gt;';   break;
            case '"':  result += '&quot;'; break;
            case '\'': result += '&#039;'; break;
            default:   result += character;
        }
    }
    return result;
};


// Usage example:

console.log(escapeHtml('<div class="message">Hi!</div>'));  // &lt;div class=&quot;message&quot;&gt;Hi!&lt;/div&gt;


// Output:
//
//     &lt;div class=&quot;message&quot;&gt;Hi!&lt;/div&gt;


// See also:
//
//     1. https://dirask.com/snippets/Node-js-escape-HTML-special-characters-DKgEnD

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
// Note: in this snippet you can find optimal solution to escape HTML special characters.

const escapeHtml = (html) => {
    let result = '';
    let escape = '';
    let helper = 0;
    let index = 0;
    for (; index < html.length; ++index) {
        switch (html.charCodeAt(index)) {
            case 34: escape = '&#34;'; break;  //  "  // &quot;
            case 38: escape = '&#38;'; break;  //  &  // &amp;
            case 39: escape = '&#39;'; break;  //  '
            case 60: escape = '&#60;'; break;  //  <  // &lt;
            case 62: escape = '&#62;'; break;  //  >  // &gt;
            default: continue;
        }
        if (helper < index) {
            result += html.substring(helper, index);
        }
        result += escape; 
        helper = index + 1;
    }
    if (helper < index) {
        result += html.substring(helper, index);
    }
    return result;
};


// Usage example:

console.log(escapeHtml('<div class="message">Hi!</div>'));  // &#60;div class=&#34;message&#34;&#62;Hi!&#60;/div&#62;


// Output:
//
//     &#60;div class=&#34;message&#34;&#62;Hi!&#60;/div&#62;