@reharis/html

Fast HTML templating using tagged template literals.

import { html } from "@reharis/html";

const name = "Ada & Grace";
const page = html`<h1>Hello, ${name}</h1>`;
// <h1>Hello, Ada &amp; Grace</h1>

Interpolated strings, numbers, and bigints are escaped. Arrays are recursively flattened. null, undefined, and booleans render nothing.

Use html.raw for a fragment that is already trusted:

const icon = html.raw(`<svg aria-hidden="true">...</svg>`);
const button = html`<button>${icon} Save</button>`;

html.raw is deliberately an explicit unsafe escape hatch. It does not sanitize input. Static template content is also assumed to be developer-owned. Interpolation escaping is suitable for text and quoted attribute values, but does not validate URLs, CSS, JavaScript, or other context-sensitive content.