escapeHTML

1/**
2 * Escapes special HTML characters in a string to prevent injection.
3 * Converts &, <, >, and " into their corresponding HTML entities.
4 *
5 * @param str - The input string to escape.
6 * @returns A string with HTML-escaped characters.
7 */
8export function escapeHTML(str: string): string {
9  return str.replace(/[&<>"]/g, tag => (
10    {
11      '&': '&amp;',
12      '<': '&lt;',
13      '>': '&gt;',
14      '"': '&quot;',
15    }[tag] || tag
16  ));
17}

1test('escapeHTML - escapes common HTML characters', () => {
2  expect(escapeHTML('<div class="test">Hello & welcome!</div>')).toBe(
3    '&lt;div class=&quot;test&quot;&gt;Hello &amp; welcome!&lt;/div&gt;'
4  );
5});
6
7test('escapeHTML - leaves normal text unchanged', () => {
8  expect(escapeHTML('Just text with no tags')).toBe('Just text with no tags');
9});
10
11test('escapeHTML - handles empty string', () => {
12  expect(escapeHTML('')).toBe('');
13});
14
15test('escapeHTML - handles only special characters', () => {
16  expect(escapeHTML('&<>"')).toBe('&amp;&lt;&gt;&quot;');
17});
18
19test('escapeHTML - ignores unlisted characters', () => {
20  expect(escapeHTML("It's > than 3 & < than 10")).toBe(
21    'It\'s &gt; than 3 &amp; &lt; than 10'
22  );
23});