https://chapterwise.app/static/js/utils/html-escape.js

1/**
2 * HTML escape utility to prevent XSS attacks
3 * Use this for any dynamic content inserted into the DOM
4 */
5window.HtmlEscape = {
6    /**
7     * Escape HTML special characters to prevent XSS
8     * @param {string} str - The string to escape
9     * @returns {string} - The escaped string
10     */
11    escape(str) {
12        if (str === null || str === undefined) {
13            return '';
14        }
15        const div = document.createElement('div');
16        div.textContent = String(str);
17        return div.innerHTML;
18    },
19
20    /**
21     * Escape a string for use in HTML attributes
22     * @param {string} str - The string to escape
23     * @returns {string} - The escaped string safe for attributes
24     */
25    attr(str) {
26        if (str === null || str === undefined) {
27            return '';
28        }
29        return String(str)
30            .replace(/&/g, '&')
31            .replace(/"/g, '"')
32            .replace(/'/g, ''')
33            .replace(/</g, '&lt;')
34            .replace(/>/g, '&gt;');
35    }
36};