Security News
Combatting Alert Fatigue by Prioritizing Malicious Intent
In 2023, data breaches surged 78% from zero-day and supply chain attacks, but developers are still buried under alerts that are unable to prevent these threats.
escape-goat
Advanced tools
The escape-goat package is a utility for escaping and unescaping HTML entities in strings. It is useful for preventing XSS attacks by sanitizing user input or rendering text in a web application.
Escape HTML
Escapes HTML entities in a string to prevent XSS attacks or render text safely in HTML documents. The code sample demonstrates how to escape a string containing HTML tags and entities.
"<div>Hello & 'world'</div>".escape()
Unescape HTML
Unescapes HTML entities in a string. This is useful when you need to convert sanitized text back to its original form for editing or processing. The code sample shows how to unescape a string that contains escaped HTML entities.
"<div>Hello & 'world'</div>".unescape()
The 'he' package is a robust HTML entity encoder/decoder written in JavaScript. It supports all named character references defined in HTML, handling even obscure and rare entities. Compared to escape-goat, 'he' offers a more comprehensive set of features for encoding and decoding HTML entities.
The 'escape-html' package is a simple and fast utility for escaping HTML entities in strings. It is focused solely on escaping strings to prevent XSS attacks, similar to escape-goat's escaping functionality, but does not provide unescaping capabilities.
The 'entities' package is a comprehensive library for encoding and decoding HTML/XML entities. It offers a wide range of functionalities, including support for numerous character encodings. It is more feature-rich compared to escape-goat, which has a more minimalistic approach.
Escape a string for use in HTML or the inverse
$ npm install escape-goat
const escapeGoat = require('escape-goat');
escapeGoat.escape('🦄 & 🐐');
//=> '🦄 & 🐐'
escapeGoat.unescape('🦄 & 🐐');
//=> '🦄 & 🐐'
escapeGoat.escape('Hello <em>World</em>');
//=> 'Hello <em>World</em>'
Escapes the following characters in the given input
string: &
<
>
"
'
Unescapes the following HTML entities in the given input
string: &
<
>
"
'
Ensure you always quote your HTML attributes to prevent possible XSS.
I couldn't find one I liked that was tiny, well-tested, and had both .escape()
and .unescape()
.
MIT © Sindre Sorhus
FAQs
Escape a string for use in HTML or the inverse
The npm package escape-goat receives a total of 4,796,113 weekly downloads. As such, escape-goat popularity was classified as popular.
We found that escape-goat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In 2023, data breaches surged 78% from zero-day and supply chain attacks, but developers are still buried under alerts that are unable to prevent these threats.
Security News
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
Security News
License exceptions modify the terms of open source licenses, impacting how software can be used, modified, and distributed. Developers should be aware of the legal implications of these exceptions.